joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003cdd4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140050318]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [0x1400c2a90], 0
mov rsi, r8
mov edi, edx
mov rbx, rcx
jne 0x14003ce0d
mov edx, 0x8ff000ff
jmp 0x14003ceac
test r8, r8
je 0x14003cea7
xor edx, edx
cmp qword [0x1400c28e0], rdx
jne 0x14003ce2c
call fcn.140039a0c
mov edx, eax
test eax, eax
js 0x14003ce3d
cmp qword [0x1400c2900], 0
jne 0x14003ce3d
call fcn.140039810
mov edx, eax
test edx, edx
js 0x14003ceac
mov r8, qword [0x1400c28e8]
cmp rbx, r8
jae 0x14003ce5a
shl rbx, 6
add rbx, qword [0x1400c28e0]
jmp 0x14003ce7b
mov rcx, qword [0x1400c2908]
add rcx, r8
cmp rbx, rcx
jae 0x14003ce79
sub rbx, r8
shl rbx, 6
add rbx, qword [0x1400c2900]
jmp 0x14003ce7b
xor ebx, ebx
test rbx, rbx
je 0x14003cea7
test byte [rbx + 0x33], 4
jne 0x14003ce9d
mov rcx, rbx
call fcn.14003a1e4
mov edx, eax
test eax, eax
jns 0x14003ce9d
cmp eax, 0x8007000e
je 0x14003ceac
xor edx, edx
sub edi, 1
je 0x14003cecb
cmp edi, 1
je 0x14003cee2
mov edx, 0x80004005
mov eax, edx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140008a98
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 0x28]
test rax, rax
je 0x14003cee2
cmp byte [rbx + 0x32], 0
jbe 0x14003cee2
movzx eax, byte [rax]
mov qword [rsi], rax
jmp 0x14003ceac
cmp dword [rbx + 0x10], 0x1000
jne 0x14003cf0f
call fcn.140042e00
test al, al
je 0x14003cf0f
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x20]
mov r9d, 3
mov edx, 0x1009
call fcn.140042bd4
jmp 0x14003cf28
mov ecx, dword [rbx + 0x10]
lea r8, [rsp + 0x20]
mov r9d, 3
mov edx, 0x1009
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x14003cea7
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR90.dll__wtoi]
mov rdx, rsi
mov ecx, eax
call fcn.14003af54
mov edx, eax
jmp 0x14003ceac
Function at 0x140040628
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x140050318]
xor rax, rsp
mov qword [rsp + 0xe0], rax
or qword [rsp + 0x28], 0xffffffffffffffff
xor esi, esi
mov rdi, rdx
mov ebx, 0x80004005
cmp rdx, rsi
je 0x1400406f7
cmp rcx, qword [0x1400c28e8]
jb 0x1400406f7
lea rdx, [rsp + 0x20]
call fcn.14003bbf4
cmp eax, esi
jl 0x1400406f7
mov ecx, dword [rsp + 0x20]
lea r9d, [rsi + 0x55]
lea r8, [rsp + 0x30]
lea edx, [rsi + 0x6e]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, esi
je 0x1400406ad
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.14003be34
cmp eax, esi
jge 0x1400406e8
mov ecx, dword [rsp + 0x20]
mov r9d, 0x55
lea r8, [rsp + 0x30]
lea edx, [r9 - 0x54]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, esi
je 0x1400406f7
lea rcx, [rsp + 0x30]
call fcn.140039118
lea rdx, [rsp + 0x28]
mov ecx, eax
mov dword [rsp + 0x20], eax
call fcn.14003d828
cmp eax, esi
jl 0x1400406f7
mov rcx, qword [rsp + 0x28]
cmp rcx, 0xffffffffffffffff
mov qword [rdi], rcx
cmovne ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140008a98
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140042a84
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x1400c2af9], 0
jne 0x140042bc7
lea rcx, str.kernel32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140042bc0
lea rdx, str.GetLocaleInfoEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCalendarInfoEx
mov rcx, rbx
mov qword [0x1400c2a98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LocaleNameToLCID
mov rcx, rbx
mov qword [0x1400c2aa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumSystemLocalesEx
mov rcx, rbx
mov qword [0x1400c2aa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumCalendarInfoExEx
mov rcx, rbx
mov qword [0x1400c2ab0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumDateFormatsExEx
mov rcx, rbx
mov qword [0x1400c2ab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumTimeFormatsEx
mov rcx, rbx
mov qword [0x1400c2ac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetThreadUILanguage
mov rcx, rbx
mov qword [0x1400c2ac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1400c2a98], 0
mov qword [0x1400c2ad0], rax
je 0x140042bb9
cmp qword [0x1400c2aa0], 0
je 0x140042bb9
cmp qword [0x1400c2aa8], 0
je 0x140042bb9
cmp qword [0x1400c2ab0], 0
je 0x140042bb9
cmp qword [0x1400c2ab8], 0
je 0x140042bb9
cmp qword [0x1400c2ac0], 0
je 0x140042bb9
cmp qword [0x1400c2ac8], 0
je 0x140042bb9
mov byte [0x1400c2af8], 1
test rax, rax
jne 0x140042bc0
mov byte [0x1400c2af8], 0
mov byte [0x1400c2af9], 1
mov al, byte [0x1400c2af8]
add rsp, 0x20
pop rbx
ret

Function at 0x140042e00
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140050318]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [0x1400c2afb], 0
jne 0x140042e59
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140042e52
cmp dword [rsp + 0x30], 2
jne 0x140042e52
cmp dword [rsp + 0x24], 6
jb 0x140042e52
call fcn.140042a84
mov byte [0x1400c2afa], al
mov byte [0x1400c2afb], 1
mov al, byte [0x1400c2afa]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140008a98
add rsp, 0x158
ret

Function at 0x140042e78
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
call fcn.140042e00
xor ebx, ebx
cmp al, bl
je 0x140042e9f
call fcn.140042a84
cmp al, bl
je 0x140042e9a
call qword [0x1400c2ad0]
mov bx, ax
mov ax, bx
jmp 0x140042ea5
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
add rsp, 0x20
pop rbx
ret
Function at 0x140042eac
Capabilities:
Get geographical location

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x190
mov rax, qword [0x140050318]
xor rax, rsp
mov qword [rsp + 0x180], rax
movsxd rbx, r8d
mov rbp, rdx
mov r12d, ecx
xor edi, edi
call fcn.140042e00
mov ecx, r12d
cmp al, dil
je 0x140042ef9
lea edx, [rdi + 0x5c]
mov r9d, ebx
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
jmp 0x140042f8e
mov r9d, 0x56
lea r8, [rsp + 0x20]
lea edx, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov r9d, 0x56
lea r8, [rsp + 0xd0]
lea edx, [r9 + 4]
mov ecx, r12d
movsxd rsi, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp esi, 1
jle 0x140042f8e
cmp eax, 1
jle 0x140042f77
lea r12d, [rax + rsi]
cmp r12d, ebx
jg 0x140042f8e
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.MSVCR90.dll_wcscpy_s]
sub ebx, esi
mov eax, 0x2d
lea rcx, [rbp + rsi*2]
lea r8, [rsp + 0xd0]
movsxd rdx, ebx
mov word [rbp + rsi*2 - 2], ax
call qword [sym.imp.MSVCR90.dll_wcscpy_s]
mov edi, r12d
jmp 0x140042f8e
cmp esi, ebx
jg 0x140042f8e
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.MSVCR90.dll_wcscpy_s]
mov edi, esi
mov eax, edi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140008a98
add rsp, 0x190
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140042fb0
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x140050318]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rcx
call fcn.140042e00
test al, al
je 0x140043003
mov r9d, 0x56
lea r8, [rsp + 0x20]
mov ecx, 0xc00
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140043003
lea rax, [rsp + 0x20]
test rax, rax
jne 0x14004301e
test rbx, rbx
je 0x140043035
xor al, al
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140008a98
add rsp, 0xe0
pop rbx
ret
test rbx, rbx
je 0x140043003
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll__wcsicmp]
test eax, eax
jne 0x140043003
mov al, 1
jmp 0x140043005

Function at 0x140044c54
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x30], 0
mov rax, rdx
xor r9d, r9d
mov rbx, rcx
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140044cf2
test rax, rax
je 0x140044cf2
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 2]
xor edx, edx
mov rcx, rax
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp rax, 0xffffffffffffffff
je 0x140044cf2
test rax, rax
je 0x140044cf2
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
and qword [rbx + 0x30], 0
and qword [rbx + 0x28], 0
mov qword [rbx + 0x18], rax
mov eax, 1
jmp 0x140044cf4
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x140045014
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
and dword [rsp + 0x58], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x58]
add rsp, 0x38
ret

Function at 0x14004503c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
xor ebx, ebx
lea r9, [rax + 0x18]
lea rdx, [rax + 0x10]
lea r8d, [rbx + 4]
mov dword [rax + 0x18], ebx
mov qword [rax - 0x18], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x50], 4
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140045078
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
and eax, 1
add rsp, 0x38
ret

Function at 0x1400450b0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
and eax, 1
add rsp, 0x38
ret

Function at 0x140046938
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x370
mov rax, qword [0x140050318]
xor rax, rsp
mov qword [rsp + 0x360], rax
or qword [rsp + 0x38], 0xffffffffffffffff
mov rbx, rcx
lea rcx, [rsp + 0x41]
xor edi, edi
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], dil
call fcn.140008ebc
lea rdx, [rsp + 0x40]
lea rcx, str.Microsoft_Sharedoffice14_
mov r8d, 0x104
mov dword [rsp + 0x30], 0x20a
call fcn.140046850
lea rdx, [rsp + 0x40]
mov r8d, 0x104
mov rcx, rbx
call fcn.140046850
lea r11, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x140046a34
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.CommonFilesDir
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x150]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x140046a34
cmp dword [rsp + 0x30], 2
jb 0x140046a34
mov eax, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x150]
shr rax, 1
mov word [rsp + rax*2 + 0x14e], di
call fcn.140046888
mov rdi, rax
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x140046a45
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140008a98
mov rbx, qword [rsp + 0x388]
add rsp, 0x370
pop rdi
ret
Function at 0x140046a6c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140050318]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor esi, esi
lea rax, [rsp + 0x38]
mov rdi, rcx
lea rdx, str.SoftwareMicrosoftOffice14.0CommonFilesPaths
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rsi
mov ebx, esi
mov dword [rsp + 0x30], 0x208
mov word [rsp + 0x40], si
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea rdx, str.mso.dll
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
cmp rcx, rsi
je 0x140046b0c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
cmp eax, esi
je 0x140046b1f
cmp eax, 0x208
ja 0x140046b1f
mov ebx, eax
shr ebx, 1
movsxd rax, ebx
cmp rax, rsi
je 0x140046b40
lea rcx, [rsp + rax*2 + 0x3e]
cmp word [rcx], 0x5c
je 0x140046b40
dec rax
dec ebx
sub rcx, 2
cmp rax, rsi
jne 0x140046b2c
movsxd rax, ebx
lea rcx, [rsp + 0x40]
mov rdx, rdi
mov word [rsp + rax*2 + 0x40], si
call fcn.140046888
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140008a98
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400471d4
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400c2b74]
inc eax
mov dword [0x1400c2b74], eax
cmp eax, 1
jne 0x1400471fc
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400c2b78], eax
call fcn.140046c2c
add rsp, 0x28
ret

Function at 0x14004bb84
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov rbx, rcx
lea rdx, str.CLSID
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004bc68
mov rcx, qword [rsp + 0x30]
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004bc58
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea rdx, str.InsecureQI
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004bc58
cmp dword [rsp + 0x58], 4
jne 0x14004bc58
mov ebx, dword [rsp + 0x60]
cmp ebx, 3
ja 0x14004bc58
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14004bc44
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14004bc54
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14004bc7a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14004bc68
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14004bc78
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x1400029bc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r8
mov r15, rdx
mov rdi, rcx
test r8, r8
jne 0x1400029e7
mov al, 1
jmp 0x140002aff
cmp dword [rcx + 0x14], 1
lea r14, [rcx + 8]
jne 0x1400029ff
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [r14], rax
mov r13d, 0x4000
and dword [rsp + 0x70], 0
xor bpl, bpl
cmp dword [rdi + 0x14], 0
je 0x140002a59
xor ebx, ebx
test rsi, rsi
je 0x140002a7f
mov eax, esi
lea rdx, [rbx + r15]
sub eax, ebx
lea r9, [rsp + 0x70]
mov r8d, r13d
mov rcx, rsi
sub rcx, rbx
cmp rcx, r13
mov rcx, qword [r14]
cmovb r8d, eax
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete bpl
jne 0x140002a7a
add rbx, r13
cmp rbx, rsi
jb 0x140002a1a
jmp 0x140002a7a
mov rcx, qword [r14]
lea r9, [rsp + 0x70]
and qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete bpl
test bpl, bpl
jne 0x140002af8
cmp byte [rdi + 0x22], 0
je 0x140002af8
cmp dword [rdi + 0x14], 0
jne 0x140002af8
xor r8d, r8d
lea rdx, [rdi + 0x3a]
lea rcx, [0x140064260]
call fcn.140001a04
test al, al
je 0x140002ae6
mov ecx, dword [rsp + 0x70]
cmp rcx, rsi
jae 0x140002a05
test ecx, ecx
je 0x140002a05
mov rbx, qword [rdi]
mov rcx, rdi
mov rax, qword [rbx + 0x28]
call qword [0x14002d478]
mov ecx, dword [rsp + 0x70]
xor r8d, r8d
sub rax, rcx
mov rcx, rdi
mov rdx, rax
mov rax, qword [rbx + 0x20]
call qword [0x14002d478]
jmp 0x140002a05
lea r8, [rdi + 0x3a]
xor edx, edx
lea rcx, [0x140064260]
call fcn.140001e94
mov byte [rdi + 0x10], 1
mov al, bpl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret

Function at 0x140002c14
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1020
call fcn.140018b00
sub rsp, rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test eax, eax
jne 0x140002c60
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140003cf8
test al, al
je 0x140002c60
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov al, bl
mov rbx, qword [rsp + 0x1030]
add rsp, 0x1020
pop rdi
ret

Function at 0x140002c88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1020
call fcn.140018b00
sub rsp, rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140002ccf
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140003cf8
test al, al
je 0x140002ccf
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x1030]
add rsp, 0x1020
pop rdi
ret
Function at 0x140002d08
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1020
call fcn.140018b00
sub rsp, rax
mov ebp, r8d
mov sil, dl
mov rdi, rcx
call fcn.1400040d0
xor ebx, ebx
cmp word [rax], 0x2e
je 0x140002d50
cmp word [rax], 0x20
je 0x140002d50
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140002d85
mov rcx, rdi
call fcn.140002c88
cmp eax, 0xffffffff
jne 0x140002d98
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140003cf8
test al, al
je 0x140002d98
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140002d98
test sil, sil
je 0x140002d94
mov edx, ebp
mov rcx, rdi
call fcn.140002fa0
xor eax, eax
jmp 0x140002db3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140002dae
cmp eax, 3
sete bl
lea eax, [rbx + 1]
jmp 0x140002db3
mov eax, 2
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140002fa0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1020
call fcn.140018b00
sub rsp, rax
mov edi, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test eax, eax
jne 0x140002ff5
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140003cf8
test al, al
je 0x140002ff5
mov edx, edi
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
lea r11, [rsp + 0x1020]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000321c
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r15
push rbp
lea rbp, [rax - 0x1178]
mov eax, 0x1270
call fcn.140018b00
sub rsp, rax
mov rsi, rdx
lea rdx, [rsp + 0x20]
mov rdi, r8
mov rbx, rcx
mov r15d, 0x800
cmp rcx, 0xffffffffffffffff
jne 0x1400032c8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400032e4
mov r8d, r15d
lea rdx, [rbp + 0x170]
mov rcx, rsi
call fcn.140003cf8
test al, al
je 0x1400032a1
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400032e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 2]
test ecx, 0xffffffee
jne 0x1400032bb
cmp eax, 0x13
je 0x1400032bb
xor al, al
jmp 0x1400032bd
mov al, 1
mov byte [rdi + 0x1044], al
jmp 0x140003379
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400032e4
or rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
jmp 0x1400032bd
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call fcn.1400079e4
mov r8, r15
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call fcn.140004200
mov eax, dword [rsp + 0x40]
lea rdx, [rsp + 0x34]
mov ecx, dword [rsp + 0x3c]
shl rcx, 0x20
add rcx, rax
mov eax, dword [rsp + 0x20]
mov dword [rdi + 0x1008], eax
mov rax, qword [rsp + 0x24]
mov qword [rdi + 0x1028], rax
mov rax, qword [rsp + 0x2c]
mov qword [rdi + 0x1030], rax
mov rax, qword [rsp + 0x34]
mov qword [rdi + 0x1000], rcx
lea rcx, [rdi + 0x1010]
mov qword [rdi + 0x1038], rax
call fcn.1400085e8
lea rcx, [rdi + 0x1018]
lea rdx, [rsp + 0x24]
call fcn.1400085e8
lea rcx, [rdi + 0x1020]
lea rdx, [rsp + 0x2c]
call fcn.1400085e8
and dword [rdi + 0x1040], 0
lea r11, [rsp + 0x1270]
mov rsi, qword [r11 + 0x18]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140003cf8
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov eax, 0x1020
call fcn.140018b00
sub rsp, rax
xor r14d, r14d
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp word [rcx], r14w
je 0x140003ea7
call fcn.140003ec8
mov rcx, rbx
call fcn.14001d698
mov rcx, rbx
mov rbp, rax
call fcn.140003ef8
test al, al
je 0x140003ddc
mov rcx, rbx
call fcn.140003ec8
test al, al
je 0x140003d90
lea rax, [rbp + 4]
cmp rdi, rax
jbe 0x140003ea7
mov r8, rdi
lea rdx, [0x14002d890]
mov rcx, rsi
call fcn.1400079e4
mov rdx, rbx
mov r8, rdi
mov rcx, rsi
call fcn.1400079a0
mov al, 1
jmp 0x140003ea9
cmp word [rbx], 0x5c
jne 0x140003ea7
cmp word [rbx + 2], 0x5c
jne 0x140003ea7
lea rax, [rbp + 6]
cmp rdi, rax
jbe 0x140003ea7
mov r8, rdi
lea rdx, [0x14002d890]
mov rcx, rsi
call fcn.1400079e4
mov r8, rdi
lea rdx, [0x14002d8a0]
mov rcx, rsi
call fcn.1400079a0
lea rdx, [rbx + 2]
jmp 0x140003d7e
lea rdx, [rsp + 0x20]
mov ecx, 0x7ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x7fe
ja 0x140003ea7
cmp word [rbx], 0x5c
je 0x140003e71
cmp word [rbx], 0x2f
je 0x140003e71
mov edx, 0x800
lea rcx, [rsp + 0x20]
call fcn.14000381c
lea rcx, [rsp + 0x20]
call fcn.14001d698
lea rcx, [rax + 4]
add rcx, rbp
cmp rdi, rcx
jbe 0x140003ea7
mov r8, rdi
lea rdx, [0x14002d890]
mov rcx, rsi
call fcn.1400079e4
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400079a0
cmp word [rbx], 0x2e
jne 0x140003d7b
cmp word [rbx + 2], 0x5c
je 0x140003e68
cmp word [rbx + 2], 0x2f
jne 0x140003d7b
add rbx, 4
jmp 0x140003d7b
lea rax, [rbp + 6]
cmp rdi, rax
jbe 0x140003ea7
mov r8, rdi
lea rdx, [0x14002d890]
mov rcx, rsi
call fcn.1400079e4
mov r8, rdi
mov word [rsp + 0x24], r14w
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400079a0
jmp 0x140003d7b
xor al, al
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret