joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c10c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov qword [rsp + 0x20], rdx
mov edx, ecx
xor esi, esi
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov ebx, esi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14001c162
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
test eax, eax
jle 0x14001c162
lea ecx, [rsi + 0x5c]
cmp word [rdi + rbx*2 - 2], cx
je 0x14001c162
mov word [rdi + rbx*2], cx
inc ebx
movsxd rcx, ebx
mov word [rdi + rcx*2], si
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14001c174
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x30
mov rbx, r8
mov rdx, rcx
lea rax, [rsp + 0x48]
mov rcx, qword [rbx]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x14001c970
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov r8d, 0x837dac3f
mov ecx, 0x75af3f9b
mov edx, 0x4f1e896d
call fcn.140001720
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rax
lea rax, [rbp - 0x28]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ca31
mov byte [rbp - 0x20], al
xor eax, eax
mov edx, 0x578e575e
mov r8d, 0x9bed7213
mov ecx, 0x6d3fe1d6
mov dword [rbp - 0x30], 3
mov qword [rbp - 0x1f], rax
mov dword [rbp - 0x17], eax
mov word [rbp - 0x13], ax
mov byte [rbp - 0x11], al
mov dword [rbp - 0x2c], InitCommonControls
call fcn.140001720
mov rcx, qword [rbp - 0x28]
mov rdx, rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
lea r9, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ca31
movups xmm0, xmmword [rbp - 0x20]
movdqu xmmword [rbx], xmm0
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400e7da0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x14001cf74
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp - 8], rax
xor r9d, r9d
mov rsi, r8
lea r8, [0x14016d030]
sub rdx, r8
mov r10d, 3
mov r11d, r9d
lea rax, [r11 + r8]
inc r11
mov cl, byte [rdx + rax]
xor cl, byte [rax]
mov byte [rbp + r11 - 0x21], cl
cmp r11, 0x18
jl 0x14001cfb2
mov ebx, 5
lea r11, [rbp - 0x28]
lea r8, [rbp - 0x1f]
lea edi, [rbx + 3]
cmp r10d, 8
jge 0x14001cff1
mov dl, byte [r8 + 1]
mov al, byte [r8]
mov cl, r10b
shr dl, cl
mov ecx, ebx
shl al, cl
jmp 0x14001d01b
mov ecx, r10d
and ecx, 0x80000007
jge 0x14001d003
dec ecx
or ecx, 0xfffffff8
inc ecx
mov dl, byte [r8 - 1]
mov eax, 8
sub eax, ecx
mov cl, al
mov al, byte [r8]
shl dl, cl
lea ecx, [r10 - 8]
shr al, cl
add dl, al
inc r10d
dec ebx
mov byte [r11], dl
inc r11
add r8, 3
dec rdi
jne 0x14001cfd9
mov al, byte [rbp - 0x28]
mov byte [rbp - 0x2c], al
mov al, byte [rbp - 0x27]
mov byte [rbp - 0x2b], al
mov al, byte [rbp - 0x26]
mov byte [rbp - 0x2d], al
mov al, byte [rbp - 0x25]
mov byte [rbp - 0x2e], al
mov al, byte [rbp - 0x24]
mov byte [rbp - 0x2f], al
mov al, byte [rbp - 0x23]
mov byte [rbp - 0x30], al
mov al, byte [rbp - 0x22]
mov byte [rbp - 0x29], al
mov al, byte [rbp - 0x21]
mov byte [rbp - 0x2a], al
lea rax, [0x140128e18]
mov al, byte [r9 + rax]
inc r9
xor byte [rbp + r9 - 0x31], al
cmp r9, 8
jl 0x14001d061
mov rax, qword [rbp - 0x30]
mov qword [rsi], rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400e7da0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x14001d4a4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x160], rax
movsxd rdi, edx
call fcn.14001d67c
lea rdx, [rsp + 0x50]
mov ecx, 0x23
call fcn.14001c10c
mov edx, 0x1ae3806c
mov ecx, 0x205235e8
mov r8d, 0xd680a53c
movsxd rbx, eax
call fcn.140001720
lea rcx, [rsp + 0x50]
lea rcx, [rcx + rbx*2]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 2]
lea rcx, [rsp + 0x50]
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001d5ca
xor eax, eax
lea ecx, [rdi - 1]
mov word [rsp + 0x40], 0x8b88
mov word [rsp + 0x45], ax
mov byte [rsp + 0x47], al
mov byte [rsp + 0x42], 0x8d
cmp ecx, 2
ja 0x14001d56f
mov al, byte [rsp + rdi + 0x3f]
jmp 0x14001d571
mov al, 1
and qword [rsp + 0x20], 0
mov edi, 4
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x44]
mov r8d, edi
mov rcx, rbx
mov byte [rsp + 0x44], al
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
and qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov r8d, edi
mov rcx, rbx
mov word [rsp + 0x41], ax
mov byte [rsp + 0x43], al
mov byte [rsp + 0x40], 0x8c
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400e7da0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14001d67c
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
lea rdx, [rsp + 0x30]
lea rcx, [0x14001d5f0]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14001d6cc
lea edx, [rbx + 2]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [rbx + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x30]
test rax, rax
setne al
add rsp, 0x20
pop rbx
ret
Function at 0x14001d6d8
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x50], rax
and dword [rsp + 0x24], 0
and dword [rsp + 0x34], 0
mov rdi, rdx
mov dword [rdx + 8], 6
lea rcx, [rsp + 0x38]
mov r8d, 0x10c
xor edx, edx
mov dword [rsp + 0x30], 0x114
call fcn.1400ea570
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 5
jne 0x14001d7d7
mov edx, 0x25928c17
mov ecx, 0x1f23394d
mov r8d, 0xe9f1a972
mov dword [rsp + 0x20], 4
call fcn.140001720
mov rbx, 0xffffffff80000000
lea r9, [rsp + 0x20]
lea r8, [rdi + 0x10]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov edx, 0xdf7703c8
mov ecx, 0xe5c6b6fe
mov r8d, 0x131426ad
mov dword [rsp + 0x20], 4
call fcn.140001720
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x24]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [rsp + 0x24]
dec ecx
je 0x14001d7d0
dec ecx
je 0x14001d7c7
cmp ecx, 2
jne 0x14001d7d7
mov dword [rdi + 0xc], 3
jmp 0x14001d7d7
mov dword [rdi + 0xc], 2
jmp 0x14001d7d7
mov dword [rdi + 0xc], 1
mov al, 1
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400e7da0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001d7fc
Capabilities:
Check os version
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x260], rax
and dword [rsp + 0x24], 0
movsxd rdi, edx
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x10c
mov dword [rsp + 0x20], 0x114
call fcn.1400ea570
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 5
jne 0x14001d92a
mov edx, 0x47dc4ab3
mov ecx, 0x7d6df963
mov r8d, 0x8bbf6ffa
call fcn.140001720
mov edx, 0x5e66e541
mov ecx, 0x64d75135
mov r8d, 0x9205c024
mov rbx, rax
call fcn.140001720
lea r8, [rbp + 0x40]
mov rcx, 0xffffffff80000000
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14001d8b3
lea r8, [rbp + 0x40]
lea edx, [rax + 5]
mov rcx, rbx
call fcn.14001c174
lea eax, [rdi - 1]
mov ebx, 1
mov dword [rbp + 0x44], 2
mov dword [rbp + 0x40], ebx
mov dword [rbp + 0x48], 4
cmp eax, 2
ja 0x14001d8d5
mov ebx, dword [rbp + rdi*4 + 0x3c]
mov edx, 0x388c00e0
mov ecx, 0x23db350
mov r8d, 0xf4ef25a9
call fcn.140001720
mov edx, 0x5999e11e
mov ecx, 0x632852ca
mov r8d, 0x95fac47b
mov rdi, rax
call fcn.140001720
lea r8, [rbp + 0x40]
mov rcx, 0xffffffff80000000
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14001d96b
lea r8, [rbp + 0x40]
mov edx, ebx
mov rcx, rdi
call fcn.14001c174
jmp 0x14001d96b
lea rdx, [rbp + 0x50]
mov ecx, 0x23
call fcn.14001c10c
mov edx, 0x7d6053a7
mov ecx, 0x47d1e013
mov r8d, 0xb10376cf
movsxd rbx, eax
call fcn.140001720
lea rcx, [rbp + 0x50]
lea rcx, [rcx + rbx*2]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400e7da0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001d9a8
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x460
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rdx
lea rdx, [rsp + 0x240]
mov ecx, 0x1a
mov r14d, r8d
call fcn.14001c10c
xor r13d, r13d
mov edx, 0xba2c4e97
mov ecx, 0x809dfded
mov r8d, 0x764f6bf9
movsxd rbx, eax
mov esi, r13d
mov ebp, r13d
mov word [rsp + 0x30], r13w
call fcn.140001720
lea rcx, [rsp + 0x240]
lea rcx, [rcx + rbx*2]
mov rdx, rax
mov r8d, r14d
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0xf5f84839
mov ecx, 0xcf49fb1d
mov r8d, 0x399b6d7d
call fcn.140001720
lea ebx, [r13 + 1]
lea r9, [0x14001d990]
mov rdx, rax
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x240]
mov r8b, bl
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call fcn.14001f9b8
cmp word [rsp + 0x30], r13w
je 0x14001daf4
lea rcx, [rsp + 0x30]
call fcn.14001fc34
test al, al
je 0x14001daf4
cmp r14d, 6
jne 0x14001da8f
mov dword [rdi + 8], 3
jmp 0x14001daa7
cmp r14d, 5
jne 0x14001da9e
mov dword [rdi + 8], 2
jmp 0x14001daa7
cmp r14d, 3
jne 0x14001daa7
mov dword [rdi + 8], ebx
lea r9, [rsp + 0x30]
lea rdx, str.BDRegionCode
lea rcx, str.General
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, 0x1df6e221
mov ecx, 0x274750e3
mov r8d, 0xd195c765
mov esi, eax
call fcn.140001720
lea r9, [rsp + 0x30]
lea rcx, str.General
mov rdx, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, eax
dec esi
je 0x14001db13
dec esi
je 0x14001db0a
cmp esi, 2
jne 0x14001db16
mov dword [rdi + 0xc], 3
jmp 0x14001db16
mov dword [rdi + 0xc], 2
jmp 0x14001db16
mov dword [rdi + 0xc], ebx
cmp ebp, 0xaf01cec2
je 0x14001db68
cmp ebp, 0xbc110012
je 0x14001db63
cmp ebp, 0xd3a535fb
je 0x14001db5a
cmp ebp, 0xdcab1f36
je 0x14001db51
cmp ebp, 0xf0cc1274
je 0x14001db48
test ebp, ebp
jne 0x14001db6f
mov dword [rdi + 0x10], r13d
jmp 0x14001db6f
mov dword [rdi + 0x10], 3
jmp 0x14001db6f
mov dword [rdi + 0x10], 4
jmp 0x14001db6f
mov dword [rdi + 0x10], 5
jmp 0x14001db6f
mov dword [rdi + 0x10], ebx
jmp 0x14001db6f
mov dword [rdi + 0x10], 2
mov al, bl
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400e7da0
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001e380
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
cmp r8d, 4
jne 0x14001e3bb
mov cl, r9b
call fcn.14001c020
mov eax, 5
jmp 0x14001e4ad
cmp r8d, 5
jne 0x14001e4ab
mov dword [rbp - 0x18], 0x320030
mov dword [rbp - 0x14], 0x470050
mov dword [rbp - 0x10], 0x560031
mov dword [rbp - 0xc], 0x30
cmp r9d, 1
je 0x14001e401
cmp r9d, 2
jne 0x14001e3f3
lea eax, [r8 + 0x32]
jmp 0x14001e3fd
cmp r9d, 3
jne 0x14001e401
lea eax, [r9 + 0x3f]
mov word [rbp - 0x10], ax
mov edx, 0xd5ed6b08
mov ecx, 0xef5cdb3c
mov r8d, 0x198e4e4d
call fcn.140001720
lea r8, [rbp - 0x20]
mov rcx, 0xffffffff80000000
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14001e4c9
mov edx, 0xc502bb
mov ecx, 0x3a74bd6b
mov r8d, 0xcca627f5
call fcn.140001720
mov rcx, qword [rbp - 0x20]
mov r9d, 1
mov rdx, rax
lea rax, [rbp - 0x18]
xor r8d, r8d
mov dword [rsp + 0x28], InitCommonControls
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 5
jne 0x14001e4c9
mov edx, 0x3a9fdf1e
mov ecx, 0x2e60dc
mov r8d, 0xf6fcfa7b
call fcn.140001720
lea r9d, [rbx + 0xb]
lea r8, [0x140128d38]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400e7da0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov eax, 4
jmp 0x14001e4ad

Function at 0x14001f0d8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0x40
mov rdx, rdi
shl eax, 0x10
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov rcx, rdi
movsxd rbx, eax
call fcn.14001f07c
test ebx, ebx
jle 0x14001f11b
mov eax, 0x2b
mov word [rdi + rbx*2], ax
inc ebx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001f128
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov esi, r8d
mov edi, edx
mov rbx, rcx
test r8d, r8d
jne 0x14001f15e
test edx, edx
jne 0x14001f15e
mov word [rcx], r14w
jmp 0x14001f220
test sil, 2
je 0x14001f178
mov rdx, rcx
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call fcn.14001f0d8
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
mov ebp, 1
test bpl, sil
je 0x14001f194
lea ecx, [rbp + 0xf]
mov rdx, rbx
call fcn.14001f0d8
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
test sil, 4
je 0x14001f1ae
mov rdx, rbx
mov ecx, 0x12
call fcn.14001f0d8
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
lea eax, [rdi - 0x30]
cmp eax, 9
jbe 0x14001f211
lea eax, [rdi - 0x41]
cmp eax, 0x19
jbe 0x14001f211
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp edi, 0x2e
ja 0x14001f1dd
movabs rdx, 0x71fe00000000
bt rdx, rdi
jb 0x14001f1ed
cmp edi, 0xbc
je 0x14001f1ed
cmp edi, 0xbe
jne 0x14001f1f1
bts eax, 8
shl eax, 0x10
mov r8d, 0x40
mov rdx, rbx
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov rcx, rbx
mov ebp, eax
call fcn.14001f07c
jmp 0x14001f219
mov word [rbx], di
mov word [rbx + 2], r14w
movsxd rcx, ebp
lea rbx, [rbx + rcx*2]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret

Function at 0x14001f780
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xe0
mov rbx, rdx
xor edx, edx
mov sil, r8b
mov rdi, rcx
lea rcx, [rax - 0x70]
lea r8d, [rdx + 0x60]
call fcn.1400ea570
lea rax, [rsp + 0x50]
mov ebp, 1
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], ebp
mov word [rsp + 0xb0], bp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
cmp sil, bpl
jne 0x14001f819
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0xe0]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14001f84c
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x10c
mov qword [rsp + 0x20], 0x114
xor ebx, ebx
call fcn.1400ea570
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
setae bl
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e7da0
add rsp, 0x150
pop rbx
ret
Function at 0x14001f8b4
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov r8, rcx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x38
ret

Function at 0x14001f8dc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
or dword [rbp + 0x7f], 0xffffffff
mov rdi, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea r8d, [rdx + 0x6c]
lea rcx, [rbp - 0x25]
mov r14d, r9d
call fcn.1400ea570
mov eax, r14d
mov dword [rbp - 0x29], 0x70
neg eax
sbb r9d, r9d
and r9d, 0x40
mov dword [rbp - 0x25], r9d
call fcn.14001f84c
lea rdx, str.runas
test eax, eax
lea rcx, str.open
mov qword [rbp - 0x11], rbx
cmovne rcx, rdx
mov qword [rbp - 9], rdi
mov qword [rbp - 1], rsi
mov qword [rbp - 0x19], rcx
lea rcx, [rbp - 0x29]
mov dword [rbp + 7], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test r14d, r14d
je 0x14001f99b
test eax, eax
je 0x14001f99b
cmp qword [rbp + 0xf], 0x20
jle 0x14001f99b
mov rcx, qword [rbp + 0x3f]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x3f]
lea rdx, [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x3f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x7f]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001fa58
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x1b8]
sub rsp, 0x2b8
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rsi, rcx
or rax, 0xffffffffffffffff
mov qword [rsp + 0x38], r9
xor ecx, ecx
mov byte [rsp + 0x30], r8b
mov qword [rsp + 0x48], rdx
mov dil, 1
inc rax
cmp word [rsi + rax*2], cx
jne 0x14001fa98
lea rbx, [rsi + rax*2]
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov dword [rbx], 0x2a
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x14001fbfd
xor r9d, r9d
test byte [rsp + 0x50], 0x10
je 0x14001fb6c
mov r8b, byte [rsp + 0x30]
test r8b, r8b
je 0x14001fbd2
cmp word [rsp + 0x7c], 0x2e
jne 0x14001fb0b
movzx eax, word [rsp + 0x7e]
test ax, ax
je 0x14001fbd7
cmp ax, 0x2e
jne 0x14001fb0b
cmp word [rbp - 0x80], r9w
je 0x14001fbd7
lea rax, [rsp + 0x7c]
mov rdx, rbx
lea rcx, [rsp + 0x7c]
sub rdx, rax
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14001fb1b
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r9w
jne 0x14001fb2f
mov r9, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov dword [rbx + rax*2], 0x5c
mov rax, qword [rbp + 0x208]
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x200]
mov qword [rsp + 0x20], rax
call fcn.14001fa58
jmp 0x14001fbc8
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14001fb85
lea rcx, [rsp + 0x7c]
mov rdx, rax
call fcn.14001fc6c
jmp 0x14001fb8a
mov eax, 1
test eax, eax
je 0x14001fbd2
lea rax, [rsp + 0x7c]
mov rdx, rbx
lea rcx, [rsp + 0x7c]
sub rdx, rax
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14001fb9e
mov r9, qword [rbp + 0x208]
mov r8, qword [rbp + 0x200]
lea rcx, [rsp + 0x50]
mov rdx, rsi
call qword [rsp + 0x38]
xor r9d, r9d
mov dil, al
mov word [rbx], r9w
test dil, dil
je 0x14001fbf2
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor r9d, r9d
test eax, eax
jne 0x14001facb
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, dil
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400e7da0
add rsp, 0x2b8
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14001fc4c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001fc62
shr eax, 4
and al, 1
jmp 0x14001fc64
xor al, al
add rsp, 0x28
ret
Function at 0x14001ffdc
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rax, rdx
mov rsi, rcx
mov qword [rcx], rdi
test rdx, rdx
je 0x140020045
mov rdx, r8
mov rcx, rax
call fcn.1400e9984
mov qword [rsi], rax
test rax, rax
je 0x140020045
mov rcx, rax
call fcn.1400eb2ac
cmp eax, 0xa00000
jle 0x140020045
mov rbx, qword [rsi]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1400eaf24
mov rcx, rbx
call fcn.1400eabf8
mov ecx, eax
call fcn.1400eb838
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp qword [rsi], rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
Function at 0x140021fa4
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
and dword [rsp + 0x30], 0
xor eax, eax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14002203c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp qword [rcx], 0xffffffffffffffff
mov rbx, r8
mov rsi, rdx
mov r14, rcx
jne 0x140022064
xor eax, eax
jmp 0x1400220a6
xor edi, edi
test ebx, ebx
je 0x1400220a4
and dword [rsp + 0x40], 0
mov rcx, qword [r14]
mov r8d, 0x400
cmp ebx, r8d
lea r9, [rsp + 0x40]
mov rdx, rsi
cmovb r8d, ebx
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400220a4
mov ecx, dword [rsp + 0x40]
add rsi, rcx
add edi, ecx
sub ebx, ecx
jne 0x14002206a
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140022160
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp qword [rcx], 0xffffffffffffffff
jne 0x14002216e
xor eax, eax
jmp 0x14002218b
mov rcx, qword [rcx]
and dword [rsp + 0x40], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret