joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e6c0
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x36], dx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
nop
lea rcx, [0x0053bc90]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
cmp word [0x0053bcb8], ax
jne 0x40e72b
mov rcx, qword [rbp + 0x28]
lea rdx, [0x0053bcba]
mov r8d, 0x55
call fcn.0040c090
lea rcx, [0x0053bc90]
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40e837
lea rcx, [0x0053bc90]
call sub.kernel32.dll_LeaveCriticalSection
mov rcx, qword [rbp + 0x28]
call fcn.0040a9e0
movzx rcx, word [rbp + 0x36]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40e7f0
cmp byte [0x0053bc88], 0
je 0x40e784
mov rcx, rbp
lea rdx, [rbp + 0x48]
movzx r8, word [rbp + 0x36]
call fcn.0040e550
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.0040b030
jmp 0x40e7f0
mov rcx, rbp
lea rdx, [rbp + 0x40]
movzx r8, word [rbp + 0x36]
call fcn.0040e280
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040b030
call sub.kernel32.dll_GetSystemDefaultUILanguage
movzx rcx, word [rbp + 0x36]
cmp cx, ax
mov word [rbp + 0x36], cx
je 0x40e7f0
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
je 0x40e7cf
mov rcx, qword [rbp + 0x28]
lea rdx, [0x0040e884]
call fcn.0040c300
call sub.kernel32.dll_GetSystemDefaultUILanguage
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov r8d, eax
call fcn.0040e280
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.0040c300
lea rcx, [0x0053bc90]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
mov word [0x0053bcb8], ax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.0040bfb0
lea rcx, [0x0053bcba]
mov rdx, rax
mov r8d, 0xaa
call sub.kernel32.dll_lstrcpynW
lea rcx, [0x0053bc90]
call sub.kernel32.dll_LeaveCriticalSection
nop
lea rcx, [rbp + 0x38]
mov edx, 3
call fcn.0040aac0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x40f210
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.0040ab70
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040c090
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.0040c3d0
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.0040f040
test al, al
jne 0x40f2de
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040c090
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.0040c3d0
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.0040f040
test al, al
jne 0x40f2de
mov rcx, qword [rbp + 0x20]
call fcn.0040a9e0
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040aac0
lea rcx, [rbp + 0x70]
call fcn.0040a9e0
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x40f340
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.0040ab70
mov rcx, qword [rbp + 0x90]
call fcn.0040ab70
nop
mov rcx, qword [rbp + 0x28]
call fcn.0040a9e0
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.0040b0b0
xor rax, rax
cmp qword [rbp + 0x90], 0
je 0x40f3e3
mov rax, qword [rbp + 0x90]
mov eax, dword [rax - 4]
cmp eax, 1
jl 0x40f41d
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x40f416
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
mov r9d, eax
call fcn.0040c5e0
jmp 0x40f41d
sub eax, 1
test eax, eax
jne 0x40f3e8
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.0040ef50
cmp qword [rbp + 0x68], 0
je 0x40f45b
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.0040f0e0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.0040b030
jmp 0x40f4f7
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.0040e6c0
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.0040f0e0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.0040b030
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40f4d0
cmp byte [0x0053bc88], 0
jne 0x40f4d0
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.0040e6c0
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.0040f0e0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040b030
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40f4f7
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.0040f210
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.0040b030
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.0040aac0
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040aac0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x4102c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x4102e0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x410304
cmp eax, 1
jae 0x410309
cmp ecx, 5
jbe 0x410315
mov dword [0x005379b0], 0x7f
jmp 0x41031f
mov dword [0x005379b0], 0x409
add rsp, 0x28
ret
Function at 0x4105c0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.004105b0
mov ebx, eax
test ebx, ebx
je 0x41060b
cmp dword [0x0051c7cc], 0xffffffff
jne 0x4105e4
mov ecx, 0xe2
call fcn.0040a650
mov ecx, ebx
call fcn.00410590
test rax, rax
jne 0x4105fd
mov ecx, 0xe2
call fcn.0040a650
jmp 0x41060b
mov ecx, dword [0x0051c7cc]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x410660
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
lea rax, [0x1c0]
test rax, rax
je 0x4106a0
cmp dword [0x0051c7cc], 0xffffffff
je 0x4106a0
mov ecx, dword [0x0051c7cc]
call sub.kernel32.dll_TlsGetValue
test rax, rax
je 0x4106a0
mov rcx, rax
call sub.kernel32.dll_LocalFree
mov ecx, dword [0x0051c7cc]
xor rdx, rdx
call sub.kernel32.dll_TlsSetValue
add rsp, 0x28
ret

Function at 0x4106e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x0053bd64], 0
je 0x41071b
mov ecx, dword [0x0051c7cc]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41072f
call fcn.004105c0
mov ecx, dword [0x0051c7cc]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41072f
mov rax, qword [0x0053bd98]
jmp 0x41072f
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x0051c7cc]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x424da0
Capabilities:
Get disk information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
mov rbp, rsp
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
nop
mov ecx, 0x104
lea rdx, [rbp + 0x254]
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jle 0x424eb5
lea rbx, [rbp + 0x254]
mov word [rbx + 4], 0
mov rcx, rbx
lea rdx, [rbp + 0x48]
mov r8d, 0x104
call sub.kernel32.dll_QueryDosDeviceW
mov esi, eax
test esi, esi
jle 0x424e9b
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0x48]
mov r8d, 0x106
call fcn.0040c090
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x28]
call fcn.0040c8b0
test eax, eax
jle 0x424e9b
xor rsi, rsi
cmp qword [rbp + 0x40], 0
je 0x424e4b
mov rax, qword [rbp + 0x40]
mov esi, dword [rax - 4]
xor rdi, rdi
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x424e5e
mov rax, qword [rbp + 0x28]
mov edi, dword [rax - 4]
lea rcx, [rbp + 0x38]
mov rdx, rbx
call fcn.0040c030
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov r8d, esi
add r8d, 1
mov r9d, edi
sub r9d, esi
call fcn.0040c5e0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
call fcn.0040c3d0
jmp 0x424eb4
add rbx, 2
cmp word [rbx], 0
jne 0x424e97
add rbx, 4
test rbx, rbx
je 0x424eb4
cmp word [rbx], 0
jne 0x424df2
nop
nop
lea rcx, [rbp + 0x30]
mov edx, 3
call fcn.0040aac0
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x468]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x425050
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbp
sub rsp, 0x2a0
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x2b8], rdx
mov qword [rbp + 0x2c0], r8
mov dword [rbp + 0x2c8], r9d
nop
mov byte [rbp + 0x28f], 0
mov rcx, qword [rbp + 0x2c0]
call fcn.0040a9e0
mov dword [rbp + 0x288], 0
mov rcx, qword [rbp + 0x2b8]
lea rdx, [rbp + 0x288]
call sub.kernel32.dll_GetFileSize
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0
jne 0x425168
cmp dword [rbp + 0x288], 0
jne 0x425168
mov ecx, 6
xor rdx, rdx
call fcn.00431250
test al, al
je 0x425168
mov rcx, qword [rbp + 0x2b8]
lea rdx, [rbp + 0x78]
mov r8d, 0x104
mov r9d, 2
call sub.kernel32.dll_GetFinalPathNameByHandleW
test eax, eax
jbe 0x425168
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x78]
mov r8d, 0x106
call fcn.0040c090
mov rcx, rbp
lea rdx, [rbp + 0x60]
mov r8, qword [rbp + 0x58]
call fcn.00424da0
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x60]
call fcn.0040b030
mov byte [rbp + 0x28f], 1
jmp 0x4252d3
cmp dword [rbp + 0x284], 0
jne 0x42517e
cmp dword [rbp + 0x288], 0
je 0x42526c
mov rcx, qword [rbp + 0x2b8]
xor rdx, rdx
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x28], 0
call sub.kernel32.dll_CreateFileMappingW
mov qword [rbp + 0x290], rax
cmp qword [rbp + 0x290], 0x3ee
je 0x42526c
nop
mov rcx, qword [rbp + 0x290]
mov edx, 4
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 1
call sub.kernel32.dll_MapViewOfFile
mov qword [rbp + 0x298], rax
cmp qword [rbp + 0x298], 0
je 0x42525f
nop
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, qword [rbp + 0x298]
lea r8, [rbp + 0x78]
mov r9d, 0x104
call fcn.00414dc0
test eax, eax
jbe 0x425252
lea rcx, [rbp + 0x48]
lea rdx, [rbp + 0x78]
mov r8d, 0x106
call fcn.0040c090
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x48]
call fcn.00424da0
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x50]
call fcn.0040b030
mov byte [rbp + 0x28f], 1
nop
mov rcx, qword [rbp + 0x298]
call sub.kernel32.dll_UnmapViewOfFile
nop
mov rcx, qword [rbp + 0x290]
call sub.kernel32.dll_CloseHandle_1
cmp byte [rbp + 0x28f], 0
jne 0x4252d2
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x2b8]
call fcn.00424f10
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x40]
call fcn.0040b030
mov rax, qword [rbp + 0x2c0]
cmp qword [rax], 0
je 0x4252d2
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov rax, qword [rbp + 0x2c0]
mov r8, qword [rax]
call fcn.00424da0
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x38]
call fcn.0040b030
mov byte [rbp + 0x28f], 1
nop
lea rcx, [rbp + 0x38]
mov edx, 6
call fcn.0040aac0
movzx rax, byte [rbp + 0x28f]
lea rsp, [rbp + 0x2a0]
pop rbp
ret
Function at 0x425390
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov byte [rbp + 0x67], 0
mov ecx, 6
xor rdx, rdx
call fcn.00431250
test al, al
je 0x4254a7
mov rcx, qword [rbp + 0x80]
xor rdx, rdx
call fcn.00427530
test al, al
je 0x4254a7
mov rcx, qword [rbp + 0x80]
call fcn.00426fa0
test al, 0x20
je 0x4254a7
mov rcx, qword [rbp + 0x80]
call fcn.0040bfb0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x5c], eax
cmp dword [rbp + 0x5c], 0xffffffff
je 0x4254a7
mov eax, dword [rbp + 0x5c]
test eax, 0x400
je 0x4254a7
mov eax, dword [rbp + 0x5c]
test eax, 0x10
je 0x425434
mov dword [rbp + 0x60], 0x2000000
jmp 0x42543b
mov dword [rbp + 0x60], 0
mov rcx, qword [rbp + 0x80]
call fcn.0040bfb0
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov eax, dword [rbp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0xffffffffffffffff
je 0x4254a7
nop
mov rcx, rbp
mov rdx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x88]
mov r9d, dword [rbp + 0x60]
call fcn.00425050
mov byte [rbp + 0x67], al
nop
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_CloseHandle_1
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x426fa0
Capabilities:
Get disk information

Disassembly:
push rbp
sub rsp, 0x490
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x488], 0
nop
movzx rax, byte [0x004271b0]
mov byte [rbp + 0x47], al
mov rcx, qword [rbp + 0x48]
mov dl, 1
call fcn.00427620
test al, al
jne 0x426ff8
mov rcx, qword [rbp + 0x48]
mov dl, 1
call fcn.00427530
test al, al
je 0x427116
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x48]
call fcn.00427ff0
lea rcx, [rbp + 0x488]
mov rdx, qword [rbp + 0x58]
call fcn.00431860
mov rcx, qword [rbp + 0x488]
call fcn.0040bfb0
mov rcx, rax
lea rdx, [rbp + 0x274]
mov r8d, 0x104
lea r9, [rbp + 0x484]
lea rax, [rbp + 0x47c]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x480]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x104
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x427111
mov eax, dword [rbp + 0x480]
test eax, 1
je 0x427088
movzx rax, byte [rbp + 0x47]
or al, 1
mov byte [rbp + 0x47], al
mov eax, dword [rbp + 0x480]
test eax, 2
je 0x4270a1
movzx rax, byte [rbp + 0x47]
or al, 2
mov byte [rbp + 0x47], al
mov eax, dword [rbp + 0x480]
test eax, 0x80
je 0x4270ba
movzx rax, byte [rbp + 0x47]
or al, 0x20
mov byte [rbp + 0x47], al
mov rcx, qword [rbp + 0x488]
call fcn.0040bfb0
mov rcx, rax
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
test eax, eax
je 0x4270ea
sub eax, 1
test eax, eax
je 0x4270f7
sub eax, 1
test eax, eax
je 0x427104
sub eax, 1
test eax, eax
jne 0x427141
movzx rax, byte [rbp + 0x47]
or al, 0x10
mov byte [rbp + 0x47], al
jmp 0x427141
movzx rax, byte [rbp + 0x47]
or al, 4
mov byte [rbp + 0x47], al
jmp 0x427141
movzx rax, byte [rbp + 0x47]
or al, 8
mov byte [rbp + 0x47], al
jmp 0x427141
call fcn.004325f0
lea rcx, [rbp + 0x50]
mov rdx, qword [0x00536b70]
call fcn.004101d0
mov rcx, qword [0x00420090]
mov dl, 1
mov r8, qword [rbp + 0x50]
call fcn.0042fdf0
mov rcx, rax
call fcn.00409ab0
nop
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.0040aac0
lea rcx, [rbp + 0x488]
call fcn.0040a9e0
movzx rax, byte [rbp + 0x47]
lea rsp, [rbp + 0x490]
pop rbp
ret
Function at 0x4272c0
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x28], rdx
mov byte [rbp + 0x3e], r8b
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x60], 0
nop
xor rbx, rbx
mov rcx, qword [rbp + 0x30]
call fcn.0040bfb0
mov rcx, rax
xor rdx, rdx
lea r8, [rbp + 0x6c]
call sub.kernel32.dll_GetFileAttributesExW
test eax, eax
setne sil
mov eax, dword [rbp + 0x6c]
test eax, 0x400
je 0x42738e
movzx rax, byte [rbp + 0x3e]
test al, al
je 0x42738e
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x60]
call fcn.00425390
test al, al
je 0x42738e
mov rcx, qword [rbp + 0x60]
call fcn.00428270
test al, al
je 0x427370
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x30]
call fcn.00427f20
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
call fcn.00431860
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x60]
call fcn.0040c3d0
mov rcx, qword [rbp + 0x60]
call fcn.0040bfb0
mov rcx, rax
xor rdx, rdx
lea r8, [rbp + 0x6c]
call sub.kernel32.dll_GetFileAttributesExW
test eax, eax
setne sil
test sil, sil
jne 0x4273cb
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
mov eax, ebx
sub eax, 0x20
cmp eax, 2
jae 0x4273cb
mov rcx, qword [rbp + 0x30]
call fcn.0040bfb0
mov rcx, rax
xor rdx, rdx
lea r8, [rbp + 0x6c]
call fcn.00427270
test eax, eax
jne 0x4273c8
mov ebx, 0x20
jmp 0x4273cb
xor rbx, rbx
test ebx, ebx
jne 0x427404
mov eax, dword [rbp + 0x6c]
test eax, 0x10
jne 0x4273fe
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x28]
call sub.kernel32.dll_FileTimeToLocalFileTime
test eax, eax
jne 0x427404
mov ebx, 0x20
jmp 0x427404
mov ebx, 0x20
test ebx, ebx
sete al
mov byte [rbp + 0x3f], al
nop
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.0040aac0
lea rcx, [rbp + 0x60]
call fcn.0040a9e0
movzx rax, byte [rbp + 0x3f]
lea rsp, [rbp + 0x90]
pop rbx
pop rsi
pop rbp
ret

Function at 0x427530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x40
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rcx, rbx
call fcn.0040bfb0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4275e2
mov ecx, eax
test ecx, 0x400
je 0x4275d7
test sil, sil
jne 0x42756f
mov al, 1
jmp 0x42760c
test eax, 0x10
je 0x42757f
xor rax, rax
jmp 0x42760c
mov rcx, rbx
call fcn.0040bfb0
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x4275ca
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x42760c
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x20
sete al
jmp 0x42760c
test eax, 0x10
sete al
jmp 0x42760c
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x427605
cmp eax, 3
je 0x427605
cmp eax, 0x7b
je 0x427605
mov rcx, rbp
mov rdx, rbx
call fcn.004274e0
test al, al
jne 0x42760a
xor rax, rax
jmp 0x42760c
mov al, 1
lea rsp, [rbp + 0x40]
pop rbx
pop rsi
pop rbp
ret
Function at 0x427620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov esi, edx
xor rdi, rdi
mov rcx, rbx
call fcn.0040bfb0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov r13d, eax
cmp r13d, 0xffffffff
je 0x427729
mov eax, r13d
test eax, 0x400
jne 0x42766a
test r13d, 0x10
setne dil
jmp 0x42774a
test sil, sil
je 0x4276ca
mov rcx, rbx
call fcn.0040bfb0
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x42774a
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
test r13d, 0x10
setne dil
jmp 0x42774a
test r13d, 0x10
je 0x4276d8
mov dil, 1
jmp 0x42774a
mov rcx, rbx
call fcn.0040bfb0
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x427724
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
xor rdi, rdi
jmp 0x42774a
mov dil, 1
jmp 0x42774a
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x427742
cmp eax, 3
je 0x427742
cmp eax, 0x7b
je 0x427742
cmp eax, 0x35
jne 0x427747
xor rdi, rdi
jmp 0x42774a
mov dil, 1
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x4278c0
Capabilities:
Get file attributes

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2f], dl
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x48], 0
nop
mov rcx, qword [rbp + 0x20]
call fcn.0040bfb0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x28], eax
mov eax, dword [rbp + 0x28]
test eax, 0x400
je 0x427973
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x427973
or eax, 0xffffffff
mov dword [rbp + 0x28], eax
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x48]
call fcn.00425390
test al, al
je 0x427973
mov rcx, qword [rbp + 0x48]
call fcn.00428270
test al, al
je 0x42795f
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x20]
call fcn.00427f20
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.00431860
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
call fcn.0040c3d0
mov rcx, qword [rbp + 0x48]
call fcn.0040bfb0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x28], eax
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040aac0
lea rcx, [rbp + 0x48]
call fcn.0040a9e0
mov eax, dword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x4279e0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov dword [rbp + 0x2c], edx
mov byte [rbp + 0x3f], r8b
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
nop
xor rax, rax
mov dword [rbp + 0x28], eax
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x30]
call fcn.0040b0b0
movzx rax, byte [rbp + 0x3f]
test al, al
je 0x427a9f
mov rcx, qword [rbp + 0x30]
call fcn.0040bfb0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
test eax, 0x400
je 0x427a9f
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x50]
call fcn.00425390
test al, al
je 0x427a9f
mov rcx, qword [rbp + 0x50]
call fcn.00428270
test al, al
je 0x427a92
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x30]
call fcn.00427f20
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
call fcn.00431860
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x50]
call fcn.0040c3d0
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.0040b0b0
mov rcx, qword [rbp + 0x58]
call fcn.0040bfb0
mov rcx, rax
mov edx, dword [rbp + 0x2c]
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x427abf
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x28], eax
nop
lea rcx, [rbp + 0x40]
mov edx, 4
call fcn.0040aac0
mov eax, dword [rbp + 0x28]
lea rsp, [rbp + 0x60]
pop rbp
ret

Function at 0x427c70
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rbx
call fcn.0040bfb0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
test eax, eax
setne sil
test sil, sil
jne 0x427ce2
call sub.kernel32.dll_GetLastError_2
mov edi, eax
mov rcx, rbx
call fcn.0040bfb0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x427cdb
mov ecx, eax
test ecx, 0x400
je 0x427cdb
test eax, 0x10
je 0x427cdb
mov rcx, rbx
call fcn.0040bfb0
mov rcx, rax
call sub.kernel32.dll_RemoveDirectoryW
test eax, eax
setne sil
jmp 0x427ce2
mov ecx, edi
call sub.kernel32.dll_SetLastError
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x428430
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
call fcn.0040bfb0
mov rcx, rax
xor rdx, rdx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x428450
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call fcn.0040bfb0
mov rcx, rax
call sub.kernel32.dll_RemoveDirectoryW
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x42e930
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x42e957
movzx rax, word [rbp + 0x2c]
jmp 0x42e959
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret