joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff3444caf4
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x170
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rbx, r9
xor edi, edi
mov esi, edi
mov rax, qword [str.lCH4]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdi
mov qword [r11 - 0xf8], rax
mov qword [r11 - 0xf0], rdi
mov qword [r11 - 0xe8], rax
mov qword [r11 - 0xe0], rdi
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.7ff3444bc98
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.7ff3444cda0
nop
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.7ff3444d0d8
nop
lea rcx, [rsp + 0x28]
call fcn.7ff3444e088
lea rcx, [rsp + 0x38]
call fcn.7ff3444e088
mov rbx, rdi
xor edx, edx
lea r8d, [rdi + 0x44]
lea rcx, [rsp + 0x124]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x120], 0x48
lea rdx, [rsp + 0x120]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
cmp eax, edi
je 0x7ff3444cc02
mov rcx, qword [rsp + 0x128]
cmp rcx, rdi
je 0x7ff3444cc02
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [rsp + 0x20]
cmove rbx, qword [rsp + 0x128]
mov dword [rsp + 0xb0], 0x70
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
mov qword [rsp + 0xb8], rbx
mov dword [rsp + 0xb4], 0x1800540
lea rax, [0x7ff34441850]
mov qword [rsp + 0xc0], rax
mov rdx, qword [rsp + 0x28]
mov eax, dword [rdx - 8]
neg eax
sbb rcx, rcx
and rcx, rdx
mov qword [rsp + 0xc8], rcx
mov rdx, qword [rsp + 0x70]
mov eax, dword [rdx - 8]
neg eax
sbb rcx, rcx
and rcx, rdx
mov qword [rsp + 0xd0], rcx
mov rdx, qword [rsp + 0x38]
mov eax, dword [rdx - 8]
neg eax
sbb rcx, rcx
and rcx, rdx
mov qword [rsp + 0xd8], rcx
mov rax, qword [rsp + 0x1a0]
movzx ecx, word [rax + 0x40]
mov dword [rsp + 0xe0], ecx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, edi
je 0x7ff3444ccd5
mov rcx, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x1a8]
mov qword [rbx], rcx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbx + 0x10], eax
or qword [rbx + 8], 0xffffffffffffffff
mov dword [rbx + 0x14], edi
jmp 0x7ff3444ccdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rcx, [rsp + 0x38]
call fcn.7ff3444cfe4
nop
lea rcx, [rsp + 0x28]
call fcn.7ff3444cfe4
nop
lea rcx, [rsp + 0x90]
call fcn.7ff3444cfe4
lea rcx, [rsp + 0x80]
call fcn.7ff3444cfe4
lea rcx, [rsp + 0x70]
call fcn.7ff3444cfe4
lea rcx, [rsp + 0x60]
call fcn.7ff3444cfe4
lea rcx, [rsp + 0x50]
call fcn.7ff3444cfe4
nop
jmp 0x7ff3444cd34
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, edi
sete dil
mov eax, edi
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x7ff3444def4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
call fcn.7ff3444e2dc
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
test eax, eax
je 0x7ff3444df41
inc edi
mov rcx, rbx
mov edx, edi
call fcn.7ff3444d558
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rcx, rbx
cmp eax, edi
jae 0x7ff3444df3a
mov edx, eax
jmp 0x7ff3444df3c
xor edx, edx
call fcn.7ff3444d5c8
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov eax, dword [rax - 8]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff3444df58
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
call fcn.7ff3444e2dc
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
test eax, eax
je 0x7ff3444dfa5
inc edi
mov rcx, rbx
mov edx, edi
call fcn.7ff3444d558
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rcx, rbx
cmp eax, edi
jae 0x7ff3444df9e
mov edx, eax
jmp 0x7ff3444dfa0
xor edx, edx
call fcn.7ff3444d5c8
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov eax, dword [rax - 8]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff3444e148
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
call fcn.7ff3444e2dc
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
je 0x7ff3444e195
inc edi
mov rcx, rbx
mov edx, edi
call fcn.7ff3444d558
mov ecx, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rbx
cmp eax, edi
jae 0x7ff3444e18e
mov edx, eax
jmp 0x7ff3444e190
xor edx, edx
call fcn.7ff3444d5c8
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov eax, dword [rax - 8]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff3444e1ac
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
call fcn.7ff3444e2dc
lea rcx, [0x7ff34444ef0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
je 0x7ff3444e209
inc edi
mov rcx, rbx
mov edx, edi
call fcn.7ff3444d558
lea rcx, [0x7ff34444ef0]
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, rbx
cmp eax, edi
jae 0x7ff3444e202
mov edx, eax
jmp 0x7ff3444e204
xor edx, edx
call fcn.7ff3444d5c8
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov eax, dword [rax - 8]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff3444e220
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rcx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test eax, eax
je 0x7ff3444e2c6
mov rdx, qword [str.lCH4]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x30], 0
mov edx, eax
lea rcx, [rsp + 0x28]
call fcn.7ff3444d558
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x7ff3444e2af
cmp eax, ebx
ja 0x7ff3444e2af
lea edx, [rax - 1]
lea rcx, [rsp + 0x28]
call fcn.7ff3444d5c8
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.7ff3444d20c
mov r11, qword [rdi]
mov ebx, dword [r11 - 8]
lea rcx, [rsp + 0x28]
call fcn.7ff3444cfe4
mov eax, ebx
jmp 0x7ff3444e2c8
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.7ff3444d5c8
nop
lea rcx, [rsp + 0x28]
call fcn.7ff3444cfe4
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x7ff3444ff30
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x7ff34484224]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, 1
sete al
add rsp, 0x28
ret

Function at 0x7ff3444ff54
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov eax, edx
test edx, edx
je 0x7ff3444ff80
cmp eax, 1
jne 0x7ff3445002f
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x7ff34484224], eax
jmp 0x7ff3445002f
mov ecx, dword [0x7ff34484224]
cmp ecx, 0xffffffff
je 0x7ff3444ff91
call qword [sym.imp.KERNEL32.dll_TlsFree]
cmp dword [0x7ff344854ec], 0
je 0x7ff3444ffae
and dword [0x7ff344854ec], 0
lea rcx, [0x7ff344852a0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
lock xadd dword [0x7ff344854a4], eax
xor ebx, ebx
inc eax
cmp eax, 1
cmovg rbx, qword [0x7ff344854e0]
test rbx, rbx
je 0x7ff3444ffd7
lock add dword [0x7ff344854a4], 0xffffffff
lock add dword [0x7ff344854a4], 0xffffffff
jne 0x7ff3445002f
test rbx, rbx
je 0x7ff3445002f
and qword [0x7ff344854e0], 0
cmp qword [rbx + 0x58], 0
je 0x7ff3445001d
lea rcx, [0x7ff34446a28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x7ff34446a08]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7ff3445001d
mov rcx, qword [rbx + 0x58]
call rax
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call fcn.7ff3444f5a0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, edi
call fcn.7ff3444f5e0
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x7ff34453f5c
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0x20
mov r9, rdx
xor edi, edi
mov rbp, r8
cmp rdx, rdi
mov rbx, rdx
mov esi, ecx
mov r8d, ecx
lea r13, [0x7ff34441678]
lea rdx, [0x7ff344416b0]
lea ecx, [rdi + 9]
cmove r9, r13
call fcn.7ff344528fc
cmp esi, 1
jne 0x7ff34453ff5
cmp rbx, rdi
jne 0x7ff34453fda
mov qword [0x7ff344842e8], r13
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 0x2f]
call fcn.7ff3444c8e8
mov rbx, rax
mov qword [0x7ff34485428], rax
cmp rax, rdi
je 0x7ff34453fee
mov dword [rbp], 1
jmp 0x7ff34453ffc
mov rcx, rbx
call fcn.7ff3444c93c
mov qword [0x7ff344842e8], rax
cmp rax, rdi
jne 0x7ff34453fb3
xor eax, eax
jmp 0x7ff34454092
mov rbx, qword [0x7ff34485428]
cmp esi, 0x64
jne 0x7ff34454013
cmp dword [0x7ff34485434], edi
jne 0x7ff34453fee
mov dword [0x7ff34485434], 1
mov eax, esi
cmp esi, edi
je 0x7ff34454033
cmp eax, 1
jne 0x7ff34454046
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [0x7ff34485428]
mov dword [0x7ff34484220], eax
jmp 0x7ff3445404b
mov ecx, dword [0x7ff34484220]
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov rbx, qword [0x7ff34485428]
cmp esi, 1
jne 0x7ff3445408f
lea rax, [0x7ff34441818]
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
mov qword [rbx], rax
lea rax, [0x7ff344442b0]
mov qword [rbx + 8], rax
lea rax, [0x7ff34453ea8]
mov qword [rbx + 0x10], rax
cmp rbp, rdi
je 0x7ff3445407b
mov edi, dword [rbp]
lea rdx, [0x7ff34441710]
mov r8d, edi
mov ecx, 9
call fcn.7ff344528fc
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r13
ret

Function at 0x7ff344540b4
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x7ff34484220]
xor ebx, ebx
cmp ecx, 0xffffffff
je 0x7ff344540cf
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x7ff344540d2
mov rax, rbx
cmp rax, rbx
je 0x7ff344540da
mov ebx, dword [rax + 0x10]
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x7ff34454698
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x20], rsi
mov rax, qword [0x7ff34484108]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r13, r8
mov r14, rdx
mov r15, rcx
mov esi, 1
and qword [rsp + 0x20], 0
call fcn.7ff344544a4
nop
mov rax, qword [str.lCH4]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x30], 0
lea rdx, [r14 + 0x18]
lea rcx, [rsp + 0x28]
call fcn.7ff3444d20c
cmp qword [r13], 0
je 0x7ff34454719
mov rdx, qword [r13]
lea rcx, [rsp + 0x28]
call fcn.7ff3444dc58
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x7ff34454769
lea r8, [rsp + 0x40]
lea rdx, [r14 + 0x18]
mov rcx, r15
call fcn.7ff3445452c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x7ff34454737
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
and qword [rsp + 0x20], 0
lea rdx, [r14 + 8]
lea rcx, [rsp + 0x28]
call fcn.7ff3444d20c
cmp qword [r13], 0
je 0x7ff3445478c
mov rdx, qword [r13]
lea rcx, [rsp + 0x28]
call fcn.7ff3444dc58
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x7ff344547dc
lea r8, [rsp + 0x40]
lea rdx, [r14 + 8]
mov rcx, r15
call fcn.7ff3445452c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x7ff344547aa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
and qword [rsp + 0x20], 0
test esi, esi
jne 0x7ff344547ee
lea rcx, [rsp + 0x28]
call fcn.7ff3444cfe4
xor eax, eax
jmp 0x7ff34454801
lea rcx, [rsp + 0x28]
call fcn.7ff3444cfe4
nop
jmp 0x7ff344547ff
mov eax, esi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.7ff344779c0
mov rsi, qword [rsp + 0x2e8]
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x7ff3445bf50
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x300
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x7ff34484108]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov r13, r8
mov rsi, rdx
mov r14, rcx
mov ebx, 1
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x48]
call fcn.7ff3444d0d8
nop
lea rdx, [0x7ff34444edc]
lea rcx, [rsp + 0x48]
call fcn.7ff3444dc58
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x7ff3445c0ef
mov rax, qword [str.lCH4]
mov qword [rsp + 0x68], rax
and qword [rsp + 0x70], 0
mov qword [rsp + 0x58], rax
and qword [rsp + 0x60], 0
mov qword [rsp + 0x38], rax
and qword [rsp + 0x40], 0
mov r12d, dword [rsp + 0x358]
lea rdx, [rsp + 0xcc]
lea rcx, [rsp + 0x58]
call fcn.7ff3444d284
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.7ff3444de48
lea r8, [rsp + 0x38]
mov rdx, rsi
lea rcx, [rsp + 0x78]
call fcn.7ff3444d3e0
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.7ff3444d20c
nop
lea rcx, [rsp + 0x78]
call fcn.7ff3444cfe4
lea r8, [rsp + 0x38]
mov rdx, r13
lea rcx, [rsp + 0x88]
call fcn.7ff3444d3e0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.7ff3444d20c
nop
lea rcx, [rsp + 0x88]
call fcn.7ff3444cfe4
mov dword [rsp + 0x28], r12d
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x48]
mov rcx, r14
call fcn.7ff3445bad0
test eax, eax
jne 0x7ff3445c0ab
xor ebx, ebx
mov dword [rsp + 0x30], ebx
jmp 0x7ff3445c0c4
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x7ff3445c002
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x38]
call fcn.7ff3444cfe4
nop
lea rcx, [rsp + 0x58]
call fcn.7ff3444cfe4
nop
lea rcx, [rsp + 0x68]
call fcn.7ff3444cfe4
nop
lea rcx, [rsp + 0x48]
call fcn.7ff3444cfe4
nop
jmp 0x7ff3445c100
mov eax, ebx
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.7ff344779c0
mov rbx, qword [rsp + 0x348]
add rsp, 0x300
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x7ff34460244
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
test ecx, ecx
je 0x7ff34460421
sub ecx, 1
je 0x7ff344602c7
sub ecx, 1
je 0x7ff3446027e
cmp ecx, 1
jne 0x7ff34460421
mov ecx, dword [0x7ff344841e0]
call fcn.7ff344740d4
jmp 0x7ff34460421
lea rdx, [0x7ff34441678]
lea rcx, [rsp + 0x28]
call fcn.7ff3444d158
nop
lea rax, [0x7ff344462c0]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x68]
mov ecx, dword [0x7ff344841e0]
call fcn.7ff34474060
nop
lea rcx, [rsp + 0x28]
call fcn.7ff3444cfe4
nop
jmp 0x7ff34460421
mov rcx, qword [0x7ff34484300]
call fcn.7ff34460220
test eax, eax
jne 0x7ff344602ed
lea rdx, [0x7ff34444f08]
lea ecx, [rax + 1]
call fcn.7ff3446a4dc
xor eax, eax
jmp 0x7ff34460426
mov edx, 0x80000000
lea rcx, [0x7ff34485218]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x7ff34460319
lea rdx, [0x7ff34444f38]
lea ecx, [rax + 1]
call fcn.7ff3446a4dc
xor eax, eax
jmp 0x7ff34460426
or edi, 0xffffffff
cmp dword [0x7ff344841e0], edi
jne 0x7ff3446034c
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x7ff344841e0], eax
cmp eax, edi
jne 0x7ff3446034c
lea rdx, [0x7ff34444f68]
mov ecx, 1
call fcn.7ff3446a4dc
xor eax, eax
jmp 0x7ff34460426
mov edx, 0x80000000
lea rcx, [0x7ff34485240]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x7ff34460378
lea rdx, [0x7ff34444f98]
lea ecx, [rax + 1]
call fcn.7ff3446a4dc
xor eax, eax
jmp 0x7ff34460426
mov rdx, qword [0x7ff34484300]
lea rcx, [rsp + 0x38]
call fcn.7ff3444d158
nop
lea rax, [0x7ff344462c0]
mov qword [rsp + 0x68], rax
mov ecx, 0x38
call fcn.7ff3444f574
test rax, rax
je 0x7ff344603d8
mov ecx, 0x5c
mov word [rax], cx
and dword [rax + 4], 0
and dword [rax + 8], 0
mov rcx, qword [str.lCH4]
mov qword [rax + 0x10], rcx
and qword [rax + 0x18], 0
and qword [rax + 0x20], 0
and dword [rax + 0x28], 0
and dword [rax + 0x2c], 0
and dword [rax + 0x30], 0
jmp 0x7ff344603da
xor eax, eax
mov qword [0x7ff344854a8], rax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x68]
mov ecx, dword [0x7ff344841e0]
call fcn.7ff34474060
mov edi, eax
lea rcx, [rsp + 0x38]
call fcn.7ff3444cfe4
test edi, edi
jns 0x7ff3446041b
lea rdx, [0x7ff34444fd0]
mov ecx, 1
call fcn.7ff3446a4dc
xor eax, eax
jmp 0x7ff34460426
jmp 0x7ff34460421
mov eax, 1
add rsp, 0x50
pop rdi
ret
Function at 0x7ff344670e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r12
push r13
push r14
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov r12d, r8d
mov rbx, rdx
mov rdi, rcx
call fcn.7ff34466f9c
test eax, eax
js 0x7ff344672b6
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.7ff3444d0d8
nop
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x30]
call fcn.7ff344675b8
mov ebx, eax
test eax, eax
js 0x7ff344672a3
mov rax, qword [rdi]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [rax + 0x18]
test eax, eax
jne 0x7ff34467169
lea rcx, [rsp + 0x30]
call fcn.7ff3444cfe4
mov eax, 0xc8008000
jmp 0x7ff344672b6
lea r8, [rdi + 0x18]
lea rdx, [rdi + 8]
mov rcx, rdi
call fcn.7ff34467758
mov ebx, eax
test eax, eax
js 0x7ff344672a3
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rdi + 0x2c], eax
or r14d, 0xffffffff
cmp eax, r14d
jne 0x7ff344671a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x7ff344671a8
xor ebx, ebx
jmp 0x7ff344671ad
mov ebx, 1
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rdi + 0x28], eax
cmp eax, r14d
jne 0x7ff344671ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x7ff344671ce
xor ecx, ecx
jmp 0x7ff344671d3
mov ecx, 1
cmp dword [rdi + 0x2c], r14d
je 0x7ff344671ea
lea rcx, [rsp + 0x30]
call fcn.7ff3444cfe4
xor eax, eax
jmp 0x7ff344672b6
sub r12d, 1
je 0x7ff3446727a
sub r12d, 1
je 0x7ff3446724b
cmp r12d, 2
je 0x7ff34467223
test ecx, ecx
jne 0x7ff34467219
test ebx, ebx
je 0x7ff34467219
lea rcx, [rsp + 0x30]
call fcn.7ff3444cfe4
xor eax, eax
jmp 0x7ff344672b6
mov ebx, 0xc8008000
jmp 0x7ff344672a3
cmp dword [rdi + 0x28], r14d
je 0x7ff3446723b
test byte [rdi + 0x28], 0x10
jne 0x7ff3446723b
mov rcx, rdi
call fcn.7ff34467b28
mov ebx, eax
jmp 0x7ff344672a3
lea rdx, [rdi + 8]
mov rcx, rdi
call fcn.7ff34467a18
mov ebx, eax
jmp 0x7ff344672a3
cmp dword [rdi + 0x28], r14d
je 0x7ff34467273
test byte [rdi + 0x28], 0x10
jne 0x7ff34467263
mov rcx, rdi
call fcn.7ff34467b28
mov ebx, eax
jmp 0x7ff344672a3
lea rdx, [rdi + 8]
mov rcx, rdi
call fcn.7ff34467a18
mov ebx, eax
jmp 0x7ff344672a3
mov ebx, 0xc8008000
jmp 0x7ff344672a3
lea rdx, [rdi + 8]
mov rcx, rdi
call fcn.7ff34467a18
mov ebx, eax
test byte [rdi + 0x28], 0x10
je 0x7ff344672a3
cmp dword [rdi + 0x28], r14d
je 0x7ff344672a3
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi + 0x18]
call fcn.7ff34467804
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.7ff3444cfe4
nop
jmp 0x7ff344672b4
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
Function at 0x7ff34467804
Capabilities:
Create directory
Set file attributes

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x90
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r12, rdx
mov rsi, rcx
mov edi, 0xc000003a
lea rdx, [0x7ff34446298]
lea rcx, [rax - 0x70]
call fcn.7ff3444d0d8
nop
xor ebx, ebx
cmp rsi, rbx
je 0x7ff34467853
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.7ff3444dc58
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, ebx
je 0x7ff344679cd
cmp r12, rbx
je 0x7ff344679e2
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2000000
mov r13d, 3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, r13d
mov edx, r13d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x7ff344679e2
mov word [rsp + 0xd0], bx
lea r14d, [r13 + 0x7d]
mov edi, r14d
mov esi, ebx
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
cmp eax, ebx
je 0x7ff344678d7
mov edi, dword [rsp + 0x58]
mov esi, edi
shr esi, 0xe
and esi, 1
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 2
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9003c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, ebx
jne 0x7ff3446791e
mov word [rsp + 0xd0], bx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, r13d
mov edx, r13d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x7ff34467996
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, 2
lea r8, [rsp + 0xd0]
mov edx, 0x9c040
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and edi, 0x2027
cmove edi, r14d
mov edx, edi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp esi, ebx
je 0x7ff344679be
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_EncryptFileW]
jmp 0x7ff344679e2
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
jmp 0x7ff344679e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xc0000035
cmp eax, 0xb7
cmove edi, ecx
mov ebx, edi
lea rcx, [rsp + 0x48]
call fcn.7ff3444cfe4
nop
jmp 0x7ff344679f6
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret