joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009138
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140009168
xor eax, eax
jmp 0x14000922b
mov rbp, rbx
cmp word [rax], si
je 0x14000918d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140009174
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140009170
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140009058
movsxd r14, eax
test eax, eax
jne 0x1400091cb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140009161
mov rcx, r14
call fcn.140007608
mov rdi, rax
test rax, rax
jne 0x1400091e4
xor ecx, ecx
call fcn.140006e3c
jmp 0x1400091c0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140009058
test eax, eax
jne 0x140009215
mov rcx, rdi
call fcn.140006e3c
jmp 0x14000921f
xor ecx, ecx
call fcn.140006e3c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000e6c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000e6e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000e6e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140004000
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x178
mov rax, qword [0x14000d008]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x40], 2
je 0x14000405c
mov eax, 2
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140004200
add rsp, 0x178
ret
mov rdx, qword [rax + 8]
mov qword [rsp + 0x170], rbx
xor ebx, ebx
cmp word [rdx], 0x5c
jne 0x1400040b8
cmp word [rdx + 2], 0x5c
jne 0x1400040b8
lea rcx, [rdx + 4]
lea edx, [rbx + 0x5c]
call fcn.140004220
test rax, rax
jne 0x140004090
lea eax, [rbx + 3]
jmp 0x1400041b8
lea rdx, [rax + 2]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x60]
mov edx, 0x2c
call fcn.140004220
test rax, rax
je 0x1400040c3
mov word [rax], bx
jmp 0x1400040c3
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], 0xf000c
call sub.WINSPOOL.DRV_OpenPrinterW
test eax, eax
jne 0x14000412d
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x58], 4
call sub.WINSPOOL.DRV_OpenPrinterW
test eax, eax
jne 0x14000412d
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x58], 8
call sub.WINSPOOL.DRV_OpenPrinterW
test eax, eax
je 0x140004138
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
jne 0x14000413f
mov eax, 4
jmp 0x1400041b8
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 2]
mov qword [rsp + 0x20], rax
call sub.WINSPOOL.DRV_GetPrinterW
mov ecx, dword [rsp + 0x30]
call fcn.140004280
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rbx, rax
lea rax, [rsp + 0x30]
mov edx, 2
mov r8, rbx
mov qword [rsp + 0x20], rax
call sub.WINSPOOL.DRV_GetPrinterW
mov r11, qword [rbx + 0x20]
xor r9d, r9d
mov qword [rbx + 8], r11
mov rcx, qword [rsp + 0x38]
lea edx, [r9 + 2]
mov r8, rbx
call sub.WINSPOOL.DRV_SetPrinterW
mov rcx, qword [rsp + 0x38]
call sub.WINSPOOL.DRV_ClosePrinter
mov rcx, rbx
call fcn.140004240
mov eax, 1
mov rbx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140004200
add rsp, 0x178
ret
Function at 0x1400045cb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000d008]
jne 0x14000421a
rol rcx, 0x10
test cx, 0xffff
jne 0x140004216
repz ret
ror rcx, 0x10
jmp 0x140004524
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000e100]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14000e1f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400045a9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000e100]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400045cb
mov rax, qword [rsp + 0x88]
mov qword [0x14000e1f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000e198], rax
mov rax, qword [0x14000e1f8]
mov qword [0x14000e070], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000e180], rax
mov dword [0x14000e060], 0xc0000409
mov dword [0x14000e064], 1
mov rax, qword [0x14000d008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000d010]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000e0f8], eax
mov ecx, 1
call fcn.140005da8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000a2a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000e0f8], 0
jne 0x140004652
mov ecx, 1
call fcn.140005da8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140004a6c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140006178
nop
cmp dword [0x14000e628], 1
je 0x140004a18
mov dword [0x14000e624], 1
mov byte [0x14000e620], r12b
test ebx, ebx
jne 0x140004a04
mov rcx, qword [0x14000f2f8]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400049f1
mov rcx, qword [0x14000f2f0]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140004990
call fcn.1400059a0
cmp qword [rdi], rax
jne 0x140004990
jmp 0x140004976
cmp rdi, rsi
jb 0x1400049f1
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400059a0
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14000f2f8]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14000f2f0]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400049cf
cmp r13, rax
je 0x1400049ef
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140004976
lea rdx, [0x14000a260]
lea rcx, [0x14000a258]
call fcn.1400047c0
lea rdx, [0x14000a270]
lea rcx, [0x14000a268]
call fcn.1400047c0
nop
test r12d, r12d
je 0x140004a27
mov ecx, 8
call fcn.140006078
test r12d, r12d
jne 0x140004a52
mov dword [0x14000e628], 1
lea ecx, [r12 + 8]
call fcn.140006078
mov ecx, r15d
call fcn.140004754
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400048e0

Function at 0x140004a78
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400048e0
Function at 0x140006754
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400059a0
xor ebx, ebx
mov rdi, rax
cmp qword [0x14000ee00], rbx
jne 0x14000685a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14000692f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000692f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000ee00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000ee08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14000ee10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14000ee20], rax
test rax, rax
je 0x140006851
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14000ee18], rax
jmp 0x140006861
mov rax, qword [0x14000ee18]
jmp 0x140006868
mov rax, qword [0x14000ee18]
mov r11, qword [0x14000ee20]
cmp rax, rdi
je 0x1400068d0
cmp r11, rdi
je 0x1400068d0
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14000ee20]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400068d0
test rax, rax
je 0x1400068d0
call rsi
test rax, rax
je 0x1400068ca
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400068ca
test byte [rsp + 0x38], 1
jne 0x1400068d0
bts ebp, 0x15
jmp 0x14000690e
mov rcx, qword [0x14000ee08]
cmp rcx, rdi
je 0x14000690e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000690e
call rax
mov rbx, rax
test rax, rax
je 0x14000690e
mov rcx, qword [0x14000ee10]
cmp rcx, rdi
je 0x14000690e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000690e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000ee00]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000692f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140006931
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x1412c4109
Capabilities:
Encode data using xor

Disassembly:
xor edi, edi
test r11, r11
lea rsp, [rsp + 8]
je 0x1412c4162
lea rbx, [0x1412ad628]
movzx edx, byte [rcx]
push 0x4792e43f
xor edx, edi
dec byte [rsp + 1]
and edx, 0xff
mov edx, dword [rbx + rdx*4]
not word [rsp + 4]
shr edi, 8
xor byte [rsp + 4], 0x30
xor edi, edx
inc rcx
xor edi, 0x8caaf0a2
sal dword [rsp + 2], 0xfa
dec r11
lea rsp, [rsp + 8]
jne 0x1412c4120
push 0x51fdc35
call fcn.1412ab2df
Function at 0x140001158
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140001904
add rsp, 0x28
jmp 0x140001158
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0xb0
xor eax, eax
mov dword [rsp + 0x44], eax
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_memset
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov qword [rsp + 0xc0], rax
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x14000ebd8], rbx
je 0x1400011c0
cmp rax, rbx
jne 0x1400011d5
mov edi, 1
mov eax, dword [0x14000ebe0]
cmp eax, 1
jne 0x1400011e2
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x14000124b
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400011a9
mov eax, dword [0x14000ebe0]
test eax, eax
jne 0x140001241
mov dword [0x14000ebe0], 1
lea r14, [0x14000b6d8]
lea rbx, [0x14000b6c0]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x140001233
test eax, eax
jne 0x140001237
cmp qword [rbx], 0
je 0x140001228
mov rax, qword [rbx]
call fcn.14000a010
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14000120d
test eax, eax
je 0x14000124b
mov eax, 0xff
jmp 0x14000139b
mov dword [0x14000e284], 1
mov eax, dword [0x14000ebe0]
cmp eax, 1
jne 0x140001273
lea rdx, [0x14000b6b8]
lea rcx, [0x14000b6a8]
call sub.msvcrt.dll__initterm
mov dword [0x14000ebe0], 2
test edi, edi
jne 0x140001280
xor eax, eax
xchg qword [0x14000ebd8], rax
cmp qword [0x14000ebe8], 0
je 0x1400012af
lea rcx, [0x14000ebe8]
call fcn.140001870
test eax, eax
je 0x1400012af
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000ebe8]
call fcn.14000a010
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x14000133d
test cl, cl
je 0x1400012e7
test edi, edi
jne 0x14000133d
test cl, cl
je 0x1400012e7
cmp byte [rbx], 0x20
ja 0x1400012e7
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x1400012d2
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400080dc
mov dword [0x14000e280], eax
cmp dword [0x14000e2a0], 0
jne 0x140001326
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000e284], 0
jne 0x14000133b
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000e280]
jmp 0x14000139b
cmp cl, 0x22
jne 0x14000134f
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x140001361
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x1400012c2
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x14000175c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400017a8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400017a0
cmp dword [rcx + 0x3c], edx
jl 0x1400017a0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400017a0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400017a8
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400018d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400018f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400018f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001904
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x20
and qword [rbp + 0x20], 0
movabs rbx, 0x2b992ddfa232
and qword [rbp + 0x18], 0
mov rax, qword [0x14000e040]
cmp rax, rbx
jne 0x1400019c8
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
shl rax, 0x18
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
lea rcx, [rbp + 0x10]
xor rax, qword [rbp + 0x10]
xor rax, rcx
lea rcx, [rbp + 0x18]
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x18]
movabs rcx, 0xffffffffffff
shl rax, 0x20
xor rax, qword [rbp + 0x18]
xor rax, qword [rbp + 0x10]
and rax, rcx
mov rcx, rax
cmp rax, rbx
jne 0x1400019c1
movabs rax, 0x2b992ddfa233
mov rcx, rax
mov qword [0x14000e040], rcx
mov rbx, qword [rsp + 0x48]
not rax
mov qword [0x14000e080], rax
add rsp, 0x20
pop rbp
ret
Function at 0x1400026d8
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x140
call sub.msvcrt.dll_memset
test rbx, rbx
je 0x1400028ba
cmp byte [rbx], 0
je 0x1400028ba
mov r15d, 0x104
lea rax, [rbp + 0x60]
mov rdi, rbx
lea rcx, [rbp + 0x60]
mov edx, r15d
sub rdi, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002762
mov al, byte [rdi + rcx]
test al, al
je 0x140002762
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140002744
test rdx, rdx
lea rax, [rcx - 1]
lea r8, [0x14000b828]
mov rdx, r15
cmovne rax, rcx
lea rcx, [rbp + 0x60]
mov byte [rax], 0
call fcn.1400035ec
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
nop dword [rax + rax]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400028ba
mov r8, r15
lea rdx, [rbp + 0x60]
lea rcx, [r8 + 0x7ffffefa]
test rcx, rcx
je 0x1400027ca
mov al, byte [rdi + rdx]
test al, al
je 0x1400027ca
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x1400027ac
test r8, r8
lea rax, [rdx - 1]
cmovne rax, rdx
test byte [rsp + 0x20], 0x10
mov byte [rax], 0
je 0x14000284a
lea rdx, [0x14000b82c]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
nop dword [rax + rax]
test eax, eax
je 0x140002880
lea rdx, [0x14000b830]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
nop dword [rax + rax]
test eax, eax
je 0x140002880
lea r8, [rsp + 0x4c]
mov rdx, r15
lea rcx, [rbp + 0x60]
call fcn.1400035ec
lea r8, [0x14000b760]
mov edx, r15d
lea rcx, [rbp + 0x60]
call fcn.14000899c
lea rcx, [rbp + 0x60]
call fcn.1400026d8
jmp 0x140002880
lea r8, [rsp + 0x4c]
mov rdx, r15
lea rcx, [rbp + 0x60]
call fcn.1400035ec
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop dword [rax + rax]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop dword [rax + rax]
test eax, eax
jne 0x1400027a5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140008f70
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x140002d68
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor edi, edi
mov rsi, r8
mov byte [rcx], dil
mov rbx, rcx
cmp byte [r8], 0x23
lea r12d, [rdi + 1]
jne 0x140002f7a
add rsi, r12
movsx rcx, byte [rsi]
call qword [sym.imp.USER32.dll_CharUpperA]
nop dword [rax + rax]
mov rcx, rsi
mov r14, rax
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
mov rsi, rax
cmp r14b, 0x41
je 0x140002e22
cmp r14b, 0x53
je 0x140002e09
cmp r14b, 0x57
jne 0x140002e22
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
jmp 0x140002f74
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
jmp 0x140002f74
and qword [rsp + 0x38], rdi
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
and dword [rsp + 0x30], edi
lea rax, [rsp + 0x40]
sub r8, rax
mov dword [rsp + 0x34], 0x104
mov edx, 0x104
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002e6a
mov al, byte [r8 + rcx]
test al, al
je 0x140002e6a
mov byte [rcx], al
add rcx, r12
sub rdx, r12
jne 0x140002e4c
test rdx, rdx
lea rax, [rcx - 1]
mov r8, rsi
mov edx, 0x104
cmovne rax, rcx
lea rcx, [rsp + 0x40]
mov byte [rax], dil
call fcn.14000899c
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
jne 0x140002f74
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x14000b760]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
jne 0x140002f63
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x140002f5c
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
nop dword [rax + rax]
test eax, eax
je 0x140002f58
lea r8, [rsp + 0x40]
mov edx, 0x104
sub r8, rbx
mov rcx, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002f45
mov al, byte [r8 + rcx]
test al, al
je 0x140002f45
mov byte [rcx], al
add rcx, r12
sub rdx, r12
jne 0x140002f27
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], dil
mov edi, r12d
jmp 0x140002f63
mov eax, dword [rsp + 0x30]
cmp eax, r12d
cmove edi, r12d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jne 0x140002f9b
jmp 0x140002f8b
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
mov r8, rsi
mov edx, 0x104
mov rcx, rbx
call fcn.14000899c
mov eax, r12d
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140008f70
mov rbx, qword [rsp + 0x198]
add rsp, 0x160
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002fc8
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
sub rsp, 0x68
and qword [rax + 0x10], 0
mov r9d, 0x20019
and dword [rax + 8], 0
lea rax, [rax + 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSetControlSession_ManagerFileRenameOperations
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
jne 0x140003073
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x70]
and qword [rsp + 0x50], 0
xor r9d, r9d
and qword [rsp + 0x48], 0
xor r8d, r8d
and qword [rsp + 0x40], 0
xor edx, edx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
nop dword [rax + rax]
test eax, eax
je 0x140003062
and dword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, dword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x140003084
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov edi, 0x104
lea rcx, [rsp + 0x20]
mov edx, edi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
test eax, eax
je 0x14000312b
lea r8, str.wininit.ini
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.14000899c
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
nop dword [rax + rax]
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll__lopen]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0xffffffff
je 0x14000312b
xor edx, edx
lea r8d, [rbx + 2]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll__llseek]
nop dword [rax + rax]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll__lclose]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140008f70
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret