joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b23f4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1800b240a
mov al, 1
jmp 0x1800b246a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1800b241b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1800b2468
mov ecx, dword [rcx + 0x18]
nop
call fcn.1800b36c4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800b2468
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800b2468
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800b2468
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1800b246a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1800b725c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800b728c
xor eax, eax
jmp 0x1800b734f
mov rbp, rbx
cmp word [rax], si
je 0x1800b72b1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800b7298
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800b7294
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800b4d3c
movsxd r14, eax
test eax, eax
jne 0x1800b72ef
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800b7285
mov rcx, r14
call fcn.1800b0e90
mov rdi, rax
test rax, rax
jne 0x1800b7308
xor ecx, ecx
call fcn.1800af0d0
jmp 0x1800b72e4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800b4d3c
test eax, eax
jne 0x1800b7339
mov rcx, rdi
call fcn.1800af0d0
jmp 0x1800b7343
xor ecx, ecx
call fcn.1800af0d0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800b9b6c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1800ac4d0
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1800b9c0d
cmp ebx, dword [rsp + 0x30]
je 0x1800b9c06
test esi, esi
je 0x1800b9c06
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1800b9be1
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1800b9bee
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1800b9bcb
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1800b9bf2
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1800b9c0f
mov eax, 1
jmp 0x1800b9c0f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800bbfd8
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800ae348
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800ae348
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1800bc128
cmp rax, 0xffffffffffffffff
je 0x1800bc128
xor edi, edi
test rbp, rbp
jle 0x1800bc0d3
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1800af058
mov rbx, rax
test rax, rax
jne 0x1800bc060
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1800bc0c9
mov edx, 0x8000
mov ecx, r14d
call fcn.1800bbe5c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800b0784
cmp eax, 0xffffffff
je 0x1800bc0a9
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800bc070
mov edx, r15d
mov ecx, r14d
call fcn.1800bbe5c
jmp 0x1800bc0c9
cmp byte [rsi + 0x38], dil
je 0x1800bc0c0
cmp dword [rsi + 0x34], 5
jne 0x1800bc0c0
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1800bc0c9
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800af0d0
jmp 0x1800bc13c
jns 0x1800bc13c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800ae348
cmp rax, 0xffffffffffffffff
jne 0x1800bc0f4
cmp byte [rsi + 0x30], dil
je 0x1800bc13c
mov edi, dword [rsi + 0x2c]
jmp 0x1800bc13c
mov ecx, r14d
call fcn.1800b36c4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800bc13c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800bc13c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800bc135
mov eax, dword [rsi + 0x2c]
jmp 0x1800bc13a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800ae348
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1800bdf50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800bdf78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800bdf78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140006020
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
mov dword [rcx], eax
mov dword [rcx + 4], eax
ret

Function at 0x1400078e0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
xor eax, eax
test edx, edx
mov dword [rcx + 0x68], edx
mov dword [rcx], eax
mov dword [rcx + 4], eax
jne 0x140007927
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
mov dword [rcx + 0x24], 0x5be0cd19
ret
mov dword [rcx + 8], 0xc1059ed8
mov dword [rcx + 0xc], 0x367cd507
mov dword [rcx + 0x10], 0x3070dd17
mov dword [rcx + 0x14], 0xf70e5939
mov dword [rcx + 0x18], 0xffc00b31
mov dword [rcx + 0x1c], 0x68581511
mov dword [rcx + 0x20], 0x64f98fa7
mov dword [rcx + 0x24], 0xbefa4fa4
ret
Function at 0x1400089a0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
xor eax, eax
test edx, edx
mov dword [rcx + 0xd0], edx
mov qword [rcx], rax
mov qword [rcx + 8], rax
jne 0x140008a24
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x28], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x48], rax
ret
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx + 0x10], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 0x18], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x20], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x28], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x30], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x38], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x40], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x48], rax
ret
Function at 0x140017bc0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbx, rcx
test rdx, rdx
je 0x140017bde
call fcn.1400179a0
jmp 0x140017c46
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ecx
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14003f610
nop
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.1400179a0
nop
cmp byte [rsp + 0x58], 0
je 0x140017c3c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140017c41
movsxd rdx, dword [rsp + 0x48]
call fcn.14001e970
mov rcx, qword [rsp + 0x50]
jmp 0x140017c41
mov rcx, qword [rsp + 0x50]
call fcn.140073030
add rsp, 0x60
pop rbx
ret
Function at 0x140017c70
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rbx, r8
mov r14, rdx
mov r15, rcx
mov eax, dword [0x1400e5cd0]
xor edi, edi
test al, 1
jne 0x140017cd1
or eax, 1
mov dword [0x1400e5cd0], eax
mov qword [0x1400e5cb8], rdi
mov qword [0x1400e5cc0], rdi
mov qword [0x1400e5cc8], rdi
lea rcx, [0x1400b41d0]
call fcn.140075530
nop
test rbx, rbx
je 0x140017cea
mov rdx, rbx
lea r13, [0x1400e5cb0]
mov rcx, r13
call fcn.1400179a0
jmp 0x140017d57
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14003f610
nop
mov rdx, qword [rsp + 0x58]
lea r13, [0x1400e5cb0]
mov rcx, r13
call fcn.1400179a0
nop
cmp byte [rsp + 0x60], 0
je 0x140017d4d
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140017d52
movsxd rdx, dword [rsp + 0x50]
call fcn.14001e970
mov rcx, qword [rsp + 0x58]
jmp 0x140017d52
mov rcx, qword [rsp + 0x58]
call fcn.140073030
or edx, 0xffffffff
xor ecx, ecx
call fcn.140019060
mov rbx, rax
mov qword [rsp + 0xb0], rax
mov r12, qword [0x1400e5cc0]
mov rsi, qword [0x1400e5cb8]
test rsi, rsi
je 0x140017dd7
mov rcx, r12
sub rcx, rsi
sar rcx, 3
mov rax, qword [0x1400e5cc8]
sub rax, rsi
sar rax, 3
cmp rcx, rax
jae 0x140017dd7
xor eax, eax
mov byte [rsp + 0x28], al
movzx eax, byte [rsp + 0xb0]
mov byte [rsp + 0x20], al
mov r9, r13
lea r8, [rsp + 0xb0]
mov edx, 1
mov rcx, r12
call fcn.140003f50
lea r11, [r12 + 8]
mov qword [0x1400e5cc0], r11
jmp 0x140017e86
mov rbp, r12
cmp rsi, r12
jbe 0x140017df2
call fcn.1400750c0
mov r12, qword [0x1400e5cc0]
mov rsi, qword [0x1400e5cb8]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rbp
test rsi, rsi
je 0x140017e20
mov rax, r12
sub rax, rsi
sar rax, 3
je 0x140017e20
cmp rsi, r12
jbe 0x140017e17
call fcn.1400750c0
sub rbp, rsi
sar rbp, 3
jmp 0x140017e23
mov rbp, rdi
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0xb0]
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.140004a00
mov r11, qword [0x1400e5cb8]
mov rsi, r11
mov rcx, qword [0x1400e5cc0]
cmp r11, rcx
jbe 0x140017e72
call fcn.1400750c0
mov rcx, qword [0x1400e5cc0]
mov r11, qword [0x1400e5cb8]
lea rax, [rsi + rbp*8]
cmp rax, rcx
ja 0x140017e80
cmp rax, r11
jae 0x140017e86
call fcn.1400750c0
nop
mov rcx, rbx
call fcn.140073030
mov r11, qword [0x1400e5cb8]
test r11, r11
je 0x140017ea8
mov rdi, qword [0x1400e5cc0]
sub rdi, r11
sar rdi, 3
lea eax, [rdi - 1]
mov dword [r15], eax
mov rcx, qword [0x1400e5cb8]
test rcx, rcx
je 0x140017ecf
mov rax, qword [0x1400e5cc0]
sub rax, rcx
sar rax, 3
je 0x140017ecf
mov qword [r14], rcx
jmp 0x140017ede
call fcn.1400750c0
mov r11, qword [0x1400e5cb8]
mov qword [r14], r11
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001c420
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3d0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1400e4340]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov r13, rcx
mov qword [rsp + 0x68], rcx
xor r14d, r14d
mov qword [rcx], r14
mov rdi, r14
mov qword [rsp + 0x58], r14
mov ebp, r14d
mov dword [rsp + 0x60], r14d
lea rsi, [r11 - 0x248]
lea rdx, [r11 - 0x248]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
or r15, 0xffffffffffffffff
cmp eax, 0x104
jbe 0x14001c517
nop
lea ebx, [rax + 0xa]
test rdi, rdi
je 0x14001c4ac
cmp ebx, ebp
jle 0x14001c505
mov ecx, ebx
call fcn.1400235c0
movsxd rbp, eax
mov dword [rsp + 0x60], ebp
mov eax, 2
mul rbp
cmovo rax, r15
mov rcx, rax
call fcn.1400725d0
mov rsi, rax
test rdi, rdi
je 0x14001c4f8
lea eax, [rbp - 1]
movsxd r8, eax
mov rdx, rdi
mov rcx, rsi
call fcn.140078b40
mov word [rsi + rbp*2 - 2], 0
mov rcx, rdi
call fcn.140073030
jmp 0x14001c4fd
mov word [rax], 0
mov rdi, rsi
mov qword [rsp + 0x58], rsi
mov rsi, rdi
mov rdx, rdi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, ebx
ja 0x14001c4a0
test eax, eax
jne 0x14001c5ac
call fcn.140079140
mov ebx, dword [rax]
lea rax, [0x1400b59c8]
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x80], 0
mov byte [rsp + 0x180], 0
mov r9d, r15d
lea r8, str.GetCurrentDirectory
mov edx, 0x100
lea rcx, [rsp + 0x80]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x78], r11
mov byte [rsp + 0x180], 0
mov r9d, r15d
lea r8, str.System
mov edx, 0x20
lea rcx, [rsp + 0x180]
call fcn.14001e6f0
mov edx, ebx
lea rcx, [rsp + 0x78]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x78]
call fcn.140073110
int3
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9d, r15d
mov r8d, 0xfde9
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14003f610
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x40], r14d
mov rcx, qword [r13]
call fcn.140073030
mov qword [r13], rbx
cmp byte [rsp + 0x50], 0
je 0x14001c60f
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001c614
movsxd rdx, dword [rsp + 0x40]
call fcn.14001e970
mov rcx, qword [rsp + 0x48]
jmp 0x14001c614
mov rcx, qword [rsp + 0x48]
call fcn.140073030
nop
mov rcx, rdi
call fcn.140073030
nop
mov rax, r13
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.1400755f0
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001c970
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
xor eax, eax
mov rdx, rcx
lea rcx, [rsp + 0x30]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], al
mov dword [rsp + 0x20], eax
call fcn.140049000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x38]
cmp eax, 0xffffffff
setne bl
cmp byte [rsp + 0x40], 0
je 0x14001c9d4
test rcx, rcx
je 0x14001c9d4
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x38]
call fcn.140073030
test bl, bl
setne al
add rsp, 0x50
pop rbx
ret

Function at 0x14001cdb0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov rdi, rcx
lea rcx, [rsp + 0x30]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x20], esi
call fcn.140049000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001ce4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14001ce4b
cmp byte [rsp + 0x40], sil
je 0x14001ce34
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001ce39
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x38]
call fcn.140073030
xor al, al
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [rsp + 0x38]
call fcn.140073030
xor al, al
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
lea rcx, [rsp + 0x48]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rdi
mov qword [rsp + 0x70], rbx
mov rbx, qword [rsp + 0x38]
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x50], rsi
mov byte [rsp + 0x58], sil
mov dword [rsp + 0x20], esi
call fcn.140049000
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
cmp byte [rsp + 0x58], sil
je 0x14001ceb6
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001cebb
movsxd rdx, dword [rsp + 0x48]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x50]
jmp 0x14001cebb
mov rcx, qword [rsp + 0x50]
call fcn.140073030
cmp byte [rsp + 0x40], sil
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x50], rsi
je 0x14001cee7
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001ceec
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x38]
call fcn.140073030
mov rsi, qword [rsp + 0x78]
mov al, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14001df70
Capabilities:
Create directory
Get file attributes

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x180
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
movzx ebp, r8b
movzx r12d, dl
mov rdi, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x40], r13b
mov dword [rsp + 0x20], r13d
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.140049000
nop
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
cmp byte [rsp + 0x40], r13b
je 0x14001e002
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001e007
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x38]
jmp 0x14001e007
mov rcx, qword [rsp + 0x38]
call fcn.140073030
test ebx, ebx
je 0x14001e017
mov al, 1
jmp 0x14001e0cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], r13d
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140049000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp byte [rsp + 0x40], 0
je 0x14001e07c
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001e081
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x38]
jmp 0x14001e081
mov rcx, qword [rsp + 0x38]
call fcn.140073030
cmp ebx, 0xffffffff
je 0x14001e0a6
test bl, 0x10
je 0x14001e0a6
test r12b, r12b
je 0x14001e0a2
test bpl, bpl
je 0x14001e0a2
mov rcx, rdi
call fcn.14001d810
xor al, al
jmp 0x14001e0cf
mov r9, rdi
mov r8d, esi
lea rdx, str.mkDir__s_
lea rcx, [rsp + 0x50]
call fcn.14001b7b0
lea rdx, [0x1400e08b0]
lea rcx, [rsp + 0x50]
call fcn.140073110
int3
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x14001e1f0
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x410
mov rax, qword [0x1400e4340]
xor rax, rsp
mov qword [rsp + 0x400], rax
xor ebp, ebp
test dl, dl
mov rsi, rcx
je 0x14001e313
mov rdx, rcx
lea r8, [0x1400b8770]
lea rcx, [rsp + 0x180]
call fcn.140049e20
lea rcx, [rsp + 0x180]
call fcn.14004a070
test rax, rax
je 0x14001e306
nop
nop
nop
nop
mov eax, dword [rsp + 0x180]
shr eax, 4
test al, 1
je 0x14001e27f
mov rcx, qword [rsp + 0x3e8]
mov dl, 1
call fcn.14001e1f0
jmp 0x14001e2f0
mov rdi, qword [rsp + 0x3e8]
lea rcx, [rsp + 0x30]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rdi
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x38], rbp
mov byte [rsp + 0x40], bpl
mov dword [rsp + 0x20], ebp
call fcn.140049000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x38]
test eax, eax
setne bl
cmp byte [rsp + 0x40], bpl
je 0x14001e2e3
test rcx, rcx
je 0x14001e2e3
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x38]
call fcn.140073030
test bl, bl
je 0x14001e39f
lea rcx, [rsp + 0x180]
call fcn.14004a070
test rax, rax
jne 0x14001e260
lea rcx, [rsp + 0x180]
call fcn.140049de0
lea rcx, [rsp + 0x30]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rsi
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x38], rbp
mov byte [rsp + 0x40], bpl
mov dword [rsp + 0x20], ebp
call fcn.140049000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rsp + 0x38]
test eax, eax
setne bl
cmp byte [rsp + 0x40], bpl
je 0x14001e36f
test rcx, rcx
je 0x14001e36f
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x38]
call fcn.140073030
mov al, bl
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.1400755f0
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.fileRemove__s_
lea rcx, [rsp + 0x48]
mov r8d, eax
mov r9, rdi
call fcn.14001b7b0
lea rdx, [0x1400e08b0]
lea rcx, [rsp + 0x48]
call fcn.140073110
int3
Function at 0x1400225f0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, rcx
call fcn.14004d6f0
test al, al
je 0x14002277c
xor ebx, ebx
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x68], rbx
mov byte [rsp + 0x70], bl
mov dword [rsp + 0x20], ebx
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0x60]
call fcn.140049000
nop
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x58], bl
mov dword [rsp + 0x20], ebx
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, qword [rsi]
lea rcx, [rsp + 0x48]
call fcn.140049000
nop
movzx eax, word [rsi + 0x14]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x50]
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rax
cmp byte [rsp + 0x58], bl
je 0x1400226be
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400226c3
movsxd rdx, dword [rsp + 0x48]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x50]
jmp 0x1400226c3
mov rcx, qword [rsp + 0x50]
call fcn.140073030
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x50], rbx
cmp byte [rsp + 0x70], 0
je 0x1400226f6
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400226fb
movsxd rdx, dword [rsp + 0x60]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x68]
jmp 0x1400226fb
mov rcx, qword [rsp + 0x68]
call fcn.140073030
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x68], rbx
cmp edi, 0x20
jle 0x140022715
mov al, 1
jmp 0x140022790
cmp edi, 5
jne 0x14002271e
xor al, al
jmp 0x140022790
mov r8d, edi
lea rdx, [0x1400b9084]
lea rcx, [rsp + 0x38]
call fcn.140009ef0
nop
mov r8, qword [rax]
lea rcx, [0x1400e34a0]
mov rax, rcx
cmp edi, dword [rax]
je 0x140022752
add ebx, 1
add rax, 0x10
cmp ebx, 0xf
jl 0x140022740
jmp 0x14002275e
movsxd rax, ebx
shl rax, 4
mov r8, qword [rax + rcx + 8]
lea rdx, str.ShellExecute_runas__failed___s_._Relaunching_directly.
lea rcx, [0x1400e5f40]
call fcn.140021100
nop
mov rcx, qword [rsp + 0x38]
call fcn.140073030
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov rcx, rsi
call fcn.140021ae0
mov al, 1
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret