joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053190
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140053237
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesWinsock2Parameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140053237
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesWinsockParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140053237
lea rcx, str.HAVE_TCPIP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140053230
cmp byte [0x140bbd005], 0
je 0x140053237
xor al, al
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x38
ret

Function at 0x140053250
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1403b3e38]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
call fcn.140053190
test al, al
je 0x1400532d7
mov qword [rsp + 0x1d0], rbx
lea rdx, [rsp + 0x20]
mov ebx, 0x202
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140053297
cmp word [rsp + 0x20], bx
je 0x1400532ae
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, ebx
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400532b5
mov byte [0x140bbd005], 1
mov rbx, qword [rsp + 0x1d0]
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140099470
add rsp, 0x1d8
ret
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140099470
add rsp, 0x1d8
ret
Function at 0x140053300
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
lea rcx, [0x140053160]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__tzset]
add rsp, 0x28
jmp 0x140053300
push rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rax, qword [0x1403b3e38]
xor rax, rsp
mov qword [rbp + 0x970], rax
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMySQL
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14005347e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov qword [rsp + 0xa90], rbx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov qword [rsp + 0xa98], rdi
xor edi, edi
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
mov ebx, edi
mov dword [rsp + 0x44], 0xff
mov dword [rsp + 0x40], 0x3ff
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x140053463
nop dword [rax]
inc ebx
cmp eax, 0xea
je 0x14005340f
test eax, eax
jne 0x140053463
cmp dword [rsp + 0x48], 1
jne 0x14005340f
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rdi
lea r8, [0x1400a18f8]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x460]
call fcn.14006a930
lea rcx, [rbp + 0x460]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov dword [rsp + 0x44], 0xff
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], 0x3ff
mov qword [rsp + 0x28], rax
mov edx, ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x1400533c0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0xa98]
mov rbx, qword [rsp + 0xa90]
mov rcx, qword [rbp + 0x970]
xor rcx, rsp
call fcn.140099470
add rsp, 0xa80
pop rbp
ret
Function at 0x140053520
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1403b3e38]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, qword [0x1401ff370]
mov rbx, rdx
mov rdi, rcx
lea rdx, [rcx + 0x30]
mov ecx, dword [0x140c2f874]
call qword [rax + 0x40]
lea rcx, [rdi + 0x30]
mov qword [rdi + 0x58], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r9d, 1
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, rdi
lea edx, [r9 + 7]
call fcn.14005b9b0
test al, al
je 0x1400535e9
mov rcx, rdi
call fcn.14005b8f0
mov rcx, qword [rdi + 0x58]
test rcx, rcx
je 0x1400535b8
mov rax, qword [0x1401ff370]
call qword [rax + 0x48]
mov qword [rdi + 0x58], 0
lea rcx, [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140099470
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test rbx, rbx
je 0x1400535f3
cmp byte [rbx], 0
jne 0x140053640
lea rcx, str.TMPDIR
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
test rax, rax
jne 0x140053632
lea rcx, str.TEMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
test rax, rax
jne 0x140053632
lea rcx, [0x1400a19c4]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
test rax, rax
je 0x140053637
cmp byte [rbx], 0
jne 0x140053640
lea rbx, str.C:TEMP
nop
mov edx, 0x3b
mov rcx, rbx
call fcn.14006a180
mov r8d, eax
lea rcx, [rsp + 0x40]
sub r8d, ebx
mov rdx, rbx
mov rsi, rax
call fcn.14006bb60
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14005ae40
mov r8d, 0x10
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.1400588d0
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400535c2
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14005ba40
test al, al
jne 0x1400535c2
lea rbx, [rsi + 1]
cmp byte [rsi], al
jne 0x140053640
mov rcx, rdi
call fcn.14005b950
mov rax, qword [rdi]
mov qword [rdi + 0x20], rax
mov eax, dword [rdi + 8]
dec eax
mov dword [rdi + 0x28], 0
mov dword [rdi + 0x2c], eax
xor al, al
jmp 0x1400535c4
Function at 0x140054480
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x1403b3e38]
xor rax, rsp
mov qword [rsp + 0x220], rax
xor ebp, ebp
mov rsi, rcx
mov edi, ebp
lea edx, [rbp + 0x40]
call fcn.140060440
mov rbx, rax
test rax, rax
je 0x1400545c4
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rax], xmm0
mov edx, 0x200
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
je 0x1400544fc
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400540d0
mov edi, eax
mov edx, 0x200
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140054522
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400540d0
add edi, eax
mov r8, rbx
lea rdx, [0x1400a1fe8]
mov rcx, rsi
call fcn.1400540d0
mov edx, 0x200
lea rcx, [rsp + 0x20]
add edi, eax
call fcn.1400546d0
test rax, rax
je 0x140054585
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400540d0
lea r8, str._data
mov edx, 0x200
lea rcx, [rsp + 0x20]
add edi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400540d0
add edi, eax
lea rcx, str.MYSQL_HOME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400545a7
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1400540d0
add edi, eax
mov r8, rbx
lea rdx, [0x14009c1cf]
mov rcx, rsi
call fcn.1400540d0
add eax, edi
test eax, eax
cmovg rbx, rbp
mov rax, rbx
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140099470
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140058920
Capabilities:
Check if file exists
Move file

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, r8d
mov rbp, rdx
mov r8d, 3
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1400589d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140069500
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 2
jne 0x140058980
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
test eax, eax
jne 0x140058980
call fcn.140059260
mov dword [rax], 0x14
jmp 0x14005899c
mov qword [rsp + 0x40], rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, rax
call fcn.140059260
mov ecx, dword [rbx]
mov rbx, qword [rsp + 0x40]
mov dword [rax], ecx
test sil, 0x18
je 0x1400589c0
call fcn.140059260
mov edx, 4
mov r9, rbp
mov r8, rdi
mov ecx, dword [rax]
mov dword [rsp + 0x20], ecx
lea ecx, [rdx + 3]
call fcn.140058bf0
mov eax, 0xffffffff
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbp, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140058ac0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsx ebx, cl
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, ebx
mov edi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x140058b00
movsx ecx, al
sub ecx, 0x41
movzx edx, cl
bt edi, edx
jae 0x140058b00
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x140058ba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140058bc4
test al, 1
je 0x140058bbc
test bl, 2
jne 0x140058bc4
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0xd
call fcn.140059260
mov dword [rax], 0xd
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
Function at 0x1400594f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x60
mov ecx, dword [0x140bc36f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [0x1401ff370]
mov rbx, rax
call qword [rcx + 0x120]
mov ecx, dword [0x140bc36f0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rbx, rbx
je 0x140059612
cmp byte [rbx + 0x74], 0
je 0x140059612
mov rcx, rbx
mov qword [rsp + 0x70], rdi
call fcn.1400592b0
mov rdx, qword [0x140bc3668]
test rdx, rdx
je 0x140059599
mov rax, qword [0x1401ff370]
lea r9, str.D:winx64_packages_build_srcmysysmy_thr_init.c
xor r8d, r8d
mov dword [rsp + 0x20], 0x17a
lea rcx, [rsp + 0x30]
call qword [rax + 0x178]
lea rcx, [0x140bc3640]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rdi, rdi
je 0x1400595a6
mov rax, qword [0x1401ff370]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x180]
jmp 0x1400595a6
lea rcx, [0x140bc3640]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x140bbda44], 0xffffffff
mov rdi, qword [rsp + 0x70]
jne 0x1400595d9
mov rcx, qword [0x140bc35f8]
test rcx, rcx
je 0x1400595cd
mov rax, qword [0x1401ff370]
call qword [rax + 0x158]
lea rcx, [0x140bc35f0]
call fcn.1400591f0
mov rcx, qword [0x140bc3668]
test rcx, rcx
je 0x1400595f2
mov rax, qword [0x1401ff370]
call qword [rax + 0x148]
lea rcx, [0x140bc3640]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
mov byte [rbx + 0x74], 2
add rsp, 0x60
pop rbx
jmp qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rsp, 0x60
pop rbx
ret

Function at 0x140059830
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
cmp byte [0x140bbda48], 0
je 0x140059844
xor al, al
add rsp, 0x28
ret
cmp byte [0x140bbda40], 0
mov qword [rsp + 0x20], rbx
mov byte [0x140bbda48], 1
jne 0x140059898
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ebx, ebx
mov dword [0x140bc36f0], eax
cmp eax, 0xffffffff
sete bl
jne 0x140059898
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, ebx
lea rdx, str.Cant_initialize_threads:_error__d_n
mov rcx, rax
call fcn.1400012d0
mov rbx, qword [rsp + 0x20]
mov al, 1
add rsp, 0x28
ret
mov byte [0x140bbda40], 1
call fcn.140059b80
call fcn.1400598d0
test al, al
jne 0x14005988c
call fcn.140059270
mov dword [0x140bbdb60], eax
call fcn.140059a40
mov rbx, qword [rsp + 0x20]
xor al, al
add rsp, 0x28
ret
Function at 0x1400598d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x60
xor bl, bl
cmp byte [0x140bbda48], bl
jne 0x1400598e8
mov al, 1
add rsp, 0x60
pop rbx
ret
mov ecx, dword [0x140bc36f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140059a34
call fcn.140059280
mov edx, 0xa8
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140059927
mov bl, 1
movzx eax, bl
add rsp, 0x60
pop rbx
ret
mov ecx, dword [0x140bc36f0]
mov rdx, rax
mov qword [rsp + 0x78], rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0x58], eax
mov rcx, qword [rsp + 0x70]
call fcn.140059c10
mov eax, dword [0x1401fed80]
lea rcx, [rsp + 0x70]
neg eax
cdqe
add rcx, rax
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x98], rcx
mov rdx, qword [0x140bc3668]
test rdx, rdx
je 0x1400599ca
mov rax, qword [0x1401ff370]
lea r9, str.D:winx64_packages_build_srcmysysmy_thr_init.c
xor r8d, r8d
mov dword [rsp + 0x20], 0x133
lea rcx, [rsp + 0x30]
call qword [rax + 0x178]
lea rcx, [0x140bc3640]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rdi, rdi
je 0x1400599d7
mov rax, qword [0x1401ff370]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x180]
jmp 0x1400599d7
lea rcx, [0x140bc3640]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsp + 0x70]
mov rdx, qword [0x140bbda50]
mov rdi, qword [rsp + 0x78]
inc rdx
mov qword [0x140bbda50], rdx
mov qword [rax + 0x68], rdx
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x60], rdx
inc dword [0x140bbda44]
mov rcx, qword [0x140bc3668]
test rcx, rcx
je 0x140059a1e
mov rdx, qword [0x1401ff370]
call qword [rdx + 0x148]
lea rcx, [0x140bc3640]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x70]
mov byte [rcx + 0x74], 1
movzx eax, bl
add rsp, 0x60
pop rbx
ret
Function at 0x14005a750
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1403b3e38]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14005a819
test al, 0x10
je 0x14005a79b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x14005a86d
mov rcx, rbx
bt eax, 0xa
jae 0x14005a7b3
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x14005a819
jmp 0x14005a86b
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x4000000
mov edx, 0x10000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14005a7e6
mov rcx, rax
jmp 0x14005a865
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x4000000
mov edx, 0x10000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14005a82d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140069500
mov eax, 0xffffffff
jmp 0x14005a86d
rdtsc
shl rdx, 0x20
lea r8, str._s._llx.deleted
or rax, rdx
lea rcx, [rsp + 0x40]
mov edx, 0x127
mov qword [rsp + 0x20], rax
mov r9, rbx
call fcn.14006ad00
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140099470
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret

Function at 0x14005c230
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, r8d
mov rdi, rcx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
test eax, eax
je 0x14005c294
mov qword [rsp + 0x30], rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, rax
call fcn.140059260
mov edx, dword [rbx]
mov rbx, qword [rsp + 0x30]
mov dword [rax], edx
test sil, 0x19
je 0x14005c284
call fcn.140059260
mov edx, 4
mov r8, rdi
mov r9d, dword [rax]
lea ecx, [rdx + 0x11]
call fcn.140058bf0
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14005fc90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14005fcaf
bt eax, 0xa
jae 0x14005fcaf
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x140068bb0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
call fcn.140068a00
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140068bf5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140068bf5
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140069500
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, rax
call fcn.140059260
mov ecx, dword [rbx]
mov rbx, qword [rsp + 0x30]
mov dword [rax], ecx
mov eax, 0xffffffff
add rsp, 0x20
pop rdi
ret

Function at 0x140068ed0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov rdi, r9
mov qword [rsp + 0x30], rax
mov rbx, r8
mov qword [rsp + 0x38], rax
mov rsi, rdx
mov qword [rsp + 0x48], rax
test r8, r8
je 0x140068f82
call fcn.140068a00
mov ecx, 0xffffffff
mov dword [rsp + 0x40], edi
shr rdi, 0x20
lea rdx, [rsp + 0x30]
cmp rbx, rcx
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
mov dword [rsp + 0x44], edi
cmovbe ecx, ebx
mov rdx, rsi
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140068f6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x140068f82
cmp eax, 0x6d
je 0x140068f82
mov ecx, eax
call fcn.140069500
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140068fa0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov rdi, r9
mov qword [rsp + 0x30], rax
mov rbx, r8
mov qword [rsp + 0x38], rax
mov rsi, rdx
mov qword [rsp + 0x48], rax
test r8, r8
je 0x140069034
call fcn.140068a00
mov ecx, 0xffffffff
mov dword [rsp + 0x40], edi
shr rdi, 0x20
lea rdx, [rsp + 0x30]
cmp rbx, rcx
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
mov dword [rsp + 0x44], edi
cmovbe ecx, ebx
mov rdx, rsi
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140069030
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140069500
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140069050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
test r8, r8
je 0x1400690ce
call fcn.140068a00
mov ecx, 0xffffffff
mov qword [rsp + 0x20], 0
cmp rbx, rcx
lea r9, [rsp + 0x50]
mov rdx, rdi
cmovbe ecx, ebx
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400690bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x1400690ce
cmp eax, 0x6d
je 0x1400690ce
mov ecx, eax
call fcn.140069500
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1400693f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
xor ebx, ebx
mov rsi, rdx
mov r9d, ecx
test r8, r8
jne 0x140069414
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdi
cmp r8, rdx
mov edi, edx
cmovbe rdi, r8
call fcn.1400689e0
test al, 8
je 0x14006944d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x40], 0xffffffffffffffff
mov ecx, r9d
call fcn.140068a00
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rsp + 0x60]
test eax, eax
jne 0x140069496
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140069500
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret

Function at 0x1400695a0
Capabilities:
Get mac address on windows

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rdi
mov rax, qword [0x1403b3e38]
xor rax, rbp
mov qword [rbp + 8], rax
mov rsi, rcx
mov dword [rbp], 0
xor ecx, ecx
lea rdx, [rbp]
mov dil, 1
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x140069658
mov eax, dword [rbp]
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x1400695f8
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1400994b0
sub rsp, rdx
lea rdx, [rbp]
lea rbx, [rsp + 0x20]
mov rcx, rbx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x140069658
test rbx, rbx
je 0x140069658
test dil, dil
je 0x140069658
cmp dword [rbx + 0x1a4], 6
jne 0x140069650
cmp dword [rbx + 0x194], 6
jne 0x140069650
lea rdx, [rbx + 0x198]
mov r8d, 6
mov rcx, rsi
call fcn.140069560
movzx edi, al
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140069621
movzx eax, dil
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.140099470
mov rbx, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x30]
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x140069d70
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x138
mov rax, qword [0x1403b3e38]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebp, r9d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
jne 0x140069dbd
lea rdx, [rsp + 0x20]
mov ecx, 0xf6
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
lea rcx, [rsp + 0x20]
cmove rcx, rbx
mov rbx, rcx
mov r9, rsi
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x140069dda
mov eax, 0xffffffff
jmp 0x140069e20
mov r8d, dword [rsp + 0x180]
mov rcx, rsi
mov edx, r8d
and edx, 0x40
or edx, ebp
or edx, 0x302
call fcn.14005a960
mov edi, eax
test eax, eax
jns 0x140069e18
call fcn.140059260
xor edx, edx
mov rcx, rsi
mov ebx, dword [rax]
call fcn.14005a6b0
call fcn.140059260
mov dword [rax], ebx
jmp 0x140069e1e
inc dword [0x140bbd684]
mov eax, edi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140099470
add rsp, 0x138
pop rdi
pop rsi
pop rbp
pop rbx
ret