joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a1f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x140]
sub rsp, 0x240
lea rax, [rsp + 0x38]
mov rdi, rcx
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x38]
lea rax, [0x0048d7e0]
xor ebx, ebx
mov edx, 0x104
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], edx
mov word [rsp + 0x38], bx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40a272
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x40a264
mov edx, dword [rsp + 0x34]
call fcn.004293f8
mov rcx, qword [rsp + 0x28]
mov dword [rsp + 0x30], eax
jmp 0x40a268
mov dword [rsp + 0x30], ebx
mov rdx, rdi
call fcn.00409b0c
mov bl, al
lea r11, [rsp + 0x240]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x40a588
Capabilities:
Get storage device properties

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x3f58]
mov eax, 0x4050
call fcn.00422ec0
sub rsp, rax
mov rax, qword [rdx + 8]
xor r14d, r14d
mov dword [rdx + 0x10], r14d
mov rbx, rdx
test rax, rax
je 0x40a5c3
mov word [rax], r14w
mov rcx, qword [rcx + 8]
mov r8d, 3
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], r14d
xor edx, edx
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x40a68b
xor edx, edx
mov dword [rbp + 0x3f60], r14d
mov r8d, 0x4000
mov qword [rsp + 0x44], r14
lea rcx, [rsp + 0x50]
call fcn.00424830
mov qword [rsp + 0x38], r14
lea rax, [rbp + 0x3f60]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x4000
mov r9d, 0xc
mov qword [rsp + 0x20], rax
mov edx, 0x2d1400
mov dword [rsp + 0x40], r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40a682
cmp dword [rbp + 0x3f60], 0x28
jb 0x40a682
mov eax, dword [rbp + 0x3f60]
lea rdx, [rsp + 0x50]
add rdx, rax
lea rcx, [rsp + 0x50]
mov eax, dword [rsp + 0x68]
mov r8, rbx
add rcx, rax
call fcn.0040a744
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x4050]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x40b190
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x140]
sub rsp, 0x240
lea rax, [rsp + 0x38]
mov rdi, rcx
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x38]
lea rax, [0x0048d7e0]
xor ebx, ebx
mov edx, 0x104
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], edx
mov word [rsp + 0x38], bx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40b212
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x40b204
mov edx, dword [rsp + 0x34]
call fcn.004293f8
mov rcx, qword [rsp + 0x28]
mov dword [rsp + 0x30], eax
jmp 0x40b208
mov dword [rsp + 0x30], ebx
mov rdx, rdi
call fcn.0040aaac
mov bl, al
lea r11, [rsp + 0x240]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x40b22c
Capabilities:
Generate random numbers via winapi

Disassembly:
test rcx, rcx
je 0x40b38d
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rsi, rdx
xor ecx, ecx
call fcn.004370d4
mov r9d, 2
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea rdi, [rax - 0x54a48e00]
lea r8d, [r9 + 6]
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
je 0x40b280
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x40], rax
jmp 0x40b285
mov rax, qword [rsp + 0x40]
and eax, 0x1ffffff
lea r9, str._I64u
shl rax, 0x20
movabs rcx, 0x4400000000000000
or rax, rdi
or r8, 0xffffffffffffffff
or rax, rcx
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.004020a8
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
lea rdi, str.SOFTWAREMetaQuotes_Software
mov qword [rsp + 0x20], rax
mov rsi, 0xffffffff80000002
mov rdx, rdi
mov rcx, rsi
mov r9d, 0x20119
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b2fd
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40b308
mov rdx, rdi
mov rcx, rsi
call fcn.00404678
lea r8, [0x0048d8c4]
mov qword [rsp + 0x20], rbx
mov rdx, rdi
mov rcx, rsi
call fcn.004045c0
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov rsi, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b35c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40b367
mov rdx, rdi
mov rcx, rsi
call fcn.00404678
lea r8, [0x0048d8c4]
mov qword [rsp + 0x20], rbx
mov rdx, rdi
mov rcx, rsi
call fcn.004045c0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x40b3d8
Capabilities:
Get common file path
Get disk information

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x348]
sub rsp, 0x448
xor ebx, ebx
lea rcx, [rsp + 0x40]
mov edx, 0x100
mov dword [rbp + 0x360], ebx
mov dword [rbp + 0x370], ebx
mov dword [rbp + 0x368], ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40b485
mov r9d, 3
lea r8, [rsp + 0x40]
lea rcx, [rbp + 0x378]
lea edx, [r9 + 1]
call fcn.00435528
mov dword [rsp + 0x38], 0x100
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r9, [rbp + 0x360]
lea rax, [rbp + 0x368]
mov word [rbp + 0x37e], bx
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x140]
lea rax, [rbp + 0x370]
mov r8d, 0x100
lea rcx, [rbp + 0x378]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [rbp + 0x360]
add rsp, 0x448
pop rbx
pop rbp
ret
Function at 0x40bad8
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x40bcc7
cmp dword [rcx + 0x10], r13d
je 0x40bcc7
call fcn.0040bd24
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x40bb27
call fcn.00422660
mov qword [rbx + 0x18], r13
mov dword [rbx + 0x14], r13d
or r15, 0xffffffffffffffff
mov qword [rbx + 0x28], r13
mov qword [rbx + 0x30], r13
mov dword [rbx + 0x38], r13d
mov byte [rbx + 0x3c], r13b
mov rcx, qword [rbx + 8]
cmp rcx, r15
je 0x40bb52
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], r15
mov esi, dword [rsp + 0xa0]
xor r9d, r9d
mov edx, ebp
mov qword [rsp + 0x30], r13
bts edx, 0x1f
mov dword [rsp + 0x28], 0x80
mov rcx, rdi
mov dword [rsp + 0x20], esi
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r15
mov qword [rbx + 8], rax
setne dil
je 0x40bcc2
mov ecx, dword [rbx + 0x10]
xor edx, edx
mov dword [rbx + 0x14], ebp
mov r12, qword [rbx + 0x28]
mov r8d, dword [rbx + 0x38]
mov rax, r12
div rcx
mov ebp, r8d
sub r12, rdx
mov r14, rdx
cmp r8d, dword [rbx + 0x20]
cmovbe ebp, dword [rbx + 0x20]
add ebp, edx
cmp ebp, ecx
cmovbe ebp, ecx
cmp ebp, r8d
jbe 0x40bbf3
mov ecx, ebp
lea rdx, [0x0047b0a0]
call fcn.0042267c
mov rdi, rax
test rax, rax
je 0x40bcbf
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x40bbec
call fcn.00422660
mov qword [rbx + 0x18], rdi
mov dword [rbx + 0x38], ebp
mov edi, 1
cmp esi, 2
je 0x40bca7
mov rcx, qword [rbx + 8]
cmp rcx, r15
je 0x40bcbf
xor r9d, r9d
mov qword [rsp + 0x88], r12
lea r8, [rsp + 0x8c]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x88], eax
cmp eax, 0xffffffff
jne 0x40bc40
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40bcbf
cmp qword [rsp + 0x88], r15
je 0x40bcbf
cmp qword [rbx + 8], r15
je 0x40bca1
mov r15, qword [rbx + 0x18]
test r15, r15
je 0x40bca1
cmp ebp, edi
jb 0x40bca1
mov esi, r13d
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x98]
mov r8d, ebp
mov edx, esi
sub r8d, esi
mov dword [rsp + 0x98], r13d
add rdx, r15
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40bca4
mov eax, dword [rsp + 0x98]
test eax, eax
je 0x40bca4
add esi, eax
cmp esi, ebp
jb 0x40bc60
jmp 0x40bca4
mov esi, r13d
mov dword [rbx + 0x30], esi
mov qword [rbx + 0x28], r12
mov dword [rbx + 0x34], r14d
mov byte [rbx + 0x3c], r13b
cmp r14d, dword [rbx + 0x30]
ja 0x40bcbf
cmp r14d, dword [rbx + 0x38]
jbe 0x40bcc2
mov dil, r13b
mov al, dil
jmp 0x40bcc9
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x40bce4
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 8]
xor eax, eax
mov dword [rsp + 0x40], eax
cmp rcx, 0xffffffffffffffff
je 0x40bd1c
test rdx, rdx
je 0x40bd1c
test r8d, r8d
je 0x40bd1c
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0x40]
mov eax, ecx
add rsp, 0x38
ret

Function at 0x40bd24
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x40bdda
cmp qword [rbx + 0x18], 0
je 0x40bdda
test dword [rbx + 0x14], 0x50000000
je 0x40bdd6
cmp dword [rbx + 0x30], 1
jb 0x40bdd6
cmp byte [rbx + 0x3c], 0
je 0x40bdd6
mov rax, qword [rbx + 0x28]
lea r8, [rsp + 0x44]
mov edx, eax
mov qword [rsp + 0x40], rax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x40], eax
cmp eax, 0xffffffff
jne 0x40bd8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40bdda
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x40bdda
mov rcx, qword [rbx + 8]
xor eax, eax
mov r8d, dword [rbx + 0x30]
mov rdx, qword [rbx + 0x18]
mov dword [rsp + 0x40], eax
cmp rcx, 0xffffffffffffffff
je 0x40bdcd
test rdx, rdx
je 0x40bdcd
test r8d, r8d
je 0x40bdcd
and qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [rsp + 0x40]
cmp dword [rbx + 0x30], eax
jne 0x40bdda
mov byte [rbx + 0x3c], 0
mov al, 1
jmp 0x40bddc
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x40bf18
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x58]
sub rsp, 0x158
mov ecx, dword [0x004bb17c]
xor ebx, ebx
mov dword [rbp + 0x70], ebx
mov dword [rbp + 0x78], 4
test ecx, ecx
jg 0x40bf83
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, pe_nt_image_headers64
call fcn.00424830
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40bff9
imul ecx, dword [rsp + 0x34], 0x64
mov eax, dword [rsp + 0x3c]
mov dword [0x004bb178], eax
add ecx, dword [rsp + 0x38]
mov dword [0x004bb17c], ecx
cmp ecx, 0x258
jl 0x40bff9
lea rax, [rbp + 0x88]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bff9
mov rcx, qword [rbp + 0x88]
lea rax, [rbp + 0x78]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x80]
lea rax, [rbp + 0x70]
xor r8d, r8d
lea rdx, str.EnableLUA
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x88]
test eax, eax
je 0x40c005
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add rsp, 0x158
pop rbx
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x80], 4
jne 0x40c01b
cmp dword [rbp + 0x70], ebx
je 0x40c01b
mov bl, 1
mov al, bl
jmp 0x40bffb
Function at 0x4122a8
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], r8
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
and qword [rcx + 8], 0
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x412406
and qword [r11 - 0x38], 0
mov r8d, 3
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [r11 - 0x48], r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x412406
and qword [rsp + 0x80], 0
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
neg eax
mov rcx, rbx
sbb rdi, rdi
and rdi, qword [rsp + 0x80]
lea r12, [rdi + 2]
mov rdx, r12
call fcn.004043a8
test al, al
je 0x4123fd
mov r15, qword [rbx]
mov ebp, 1
test r15, r15
je 0x4123b7
cmp rdi, rbp
jb 0x4123b7
xor esi, esi
mov r12d, 0xfffffff
and dword [rsp + 0x80], 0
lea rdx, [rsi + r15]
mov r8d, edi
lea r9, [rsp + 0x80]
sub r8d, esi
mov rax, rdi
sub rax, rsi
mov rcx, r14
cmp rax, r12
cmova r8d, r12d
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4123b1
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x4123b1
add rsi, rax
cmp rsi, rdi
jb 0x412364
lea r12, [rdi + 2]
jmp 0x4123b9
xor esi, esi
cmp rsi, rdi
jne 0x4123fd
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x10]
mov qword [rbx + 8], rdi
cmp r12, rdx
jbe 0x4123e4
add rdx, 0x10
mov rcx, rbx
call fcn.004043a8
test al, al
je 0x412409
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov byte [rcx + rax], 0
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov byte [rcx + rax + 1], 0
jmp 0x412409
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bpl, bpl
mov rbx, qword [rsp + 0x70]
mov al, bpl
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x4127b4
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x598]
sub rsp, 0x690
cmp dword [rcx + 0x40], 0x10
mov rbx, rcx
jbe 0x4128c1
xor edx, edx
lea rcx, [rbp + 0x340]
mov r8d, 0x250
call fcn.00424830
mov r8, qword [rbx + 0x38]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str._s.
lea rax, [0x0048e198]
mov dword [rsp + 0x34], 0x200
xor esi, esi
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x30], esi
mov word [rsp + 0x38], si
call fcn.004012e8
mov rcx, qword [rsp + 0x28]
lea rdx, [rbp + 0x340]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x4128b4
test byte [rbp + 0x340], 0x10
jne 0x41288d
mov r8, qword [rbx + 0x38]
lea r9, [rbp + 0x36c]
lea rdx, [0x00491de8]
lea rcx, [rsp + 0x20]
call fcn.004012e8
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call fcn.00412424
test al, al
je 0x41288d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [rbx + 0xcb49]
test al, al
jne 0x4128ab
lea rdx, [rbp + 0x340]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41284c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rbx + 0x9650]
mov rax, qword [rcx]
call qword [rax + 0x18]
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x412a20
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
xor edi, edi
mov r14, rdx
mov rsi, rcx
test rdx, rdx
je 0x412cb7
lea rax, [rsp + 0x68]
mov qword [rbp + 0xb8], rdi
mov qword [rsp + 0x58], rax
lea ecx, [rdi + 0x18]
lea rax, [0x004907b0]
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x50], rax
mov rax, qword [rdx]
mov dword [rsp + 0x64], 0x80
mov word [rsp + 0x68], di
mov r12, qword [rax + 0xa0]
call fcn.004228d4
mov rbx, rax
test rax, rax
je 0x412ccb
lea rcx, str.SELECT__FROM_Win32_VideoController
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x412ccb
lea ecx, [rdi + 0x18]
mov qword [rbp + 0xc0], rbx
mov r15, rax
call fcn.004228d4
mov rbx, rax
test rax, rax
je 0x412ccb
lea rcx, [0x00492f10]
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x412ccb
mov rdx, qword [rbx]
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x28], rax
lea r9d, [rdi + 0x30]
mov r8, r15
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov qword [rbp + 0xc8], rbx
call r12
lea rcx, [rbp + 0xc8]
mov ebx, eax
call fcn.00412910
lea rcx, [rbp + 0xc0]
call fcn.00412910
test ebx, ebx
js 0x412cb2
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x412caf
or r14, 0xffffffffffffffff
lea rdx, [rbp + 0xc8]
mov dword [rbp + 0xc8], edi
mov qword [rbp + 0xc0], rdi
lea r9, [rbp + 0xc0]
mov rax, qword [rcx]
mov r8d, 1
mov qword [rsp + 0x20], rdx
mov edx, r14d
call qword [rax + 0x20]
test eax, eax
jne 0x412c9d
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x412c9d
cmp dword [rbp + 0xc8], edi
je 0x412c97
xorps xmm0, xmm0
lea rbx, str.Caption
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rdi
call qword [rax + 0x20]
test eax, eax
jns 0x412bf2
lea rdx, str.n_a
jmp 0x412c48
movzx eax, word [rsp + 0x30]
cmp eax, 3
je 0x412c2d
mov rcx, rsi
cmp eax, 8
je 0x412c0d
lea rdx, str.n_a
jmp 0x412c4b
cmp qword [rsp + 0x38], rdi
lea rdx, [0x00492f18]
cmovne rdx, qword [rsp + 0x38]
call fcn.00412974
lea rdx, [0x00492fa8]
jmp 0x412c48
mov r8d, dword [rsp + 0x38]
lea rdx, [0x00492f20]
lea rcx, [rsp + 0x50]
call fcn.004012e8
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.00412974
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, r14
inc rax
cmp word [rbx + rax*2], di
jne 0x412c5e
mov rcx, qword [rbp + 0xc0]
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], di
jne 0x412bca
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
jne 0x412b61
jmp 0x412caf
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x412caf
mov rax, qword [rcx]
call qword [rax + select]
mov dil, 1
mov al, dil
jmp 0x412cb9
xor al, al
add rsp, 0x170
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x8007000e
call fcn.004224d0
int3
Function at 0x413960
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x4139fe
cmp word [rcx], di
je 0x4139fe
call fcn.004135f0
test al, al
je 0x4139fe
lea rax, [0x00492fd0]
or r8, 0xffffffffffffffff
mov qword [rsp + 0x28], rax
lea r9, str._scheckwritepermissions._s
mov edx, 0x103
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x40]
call fcn.004020a8
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 3]
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x4139fe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
jmp 0x413a00
xor al, al
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret
Function at 0x4157e8
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
xor r15d, r15d
cmp qword [0x004e30d8], r15
jne 0x41583f
lea rdx, [0x0047b0a0]
mov ecx, 0x200000
call fcn.0042267c
mov qword [0x004e30d8], rax
test rax, rax
je 0x415a32
mov word [rax], r15w
cmp qword [0x004ee5f0], r15
mov ebx, 4
jne 0x41586a
mov r9d, ebx
mov edx, 0x22000
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x004ee5f0], rax
lea r12, [0x004e1aa0]
mov rcx, r12
call fcn.00413bd4
call fcn.00414770
call fcn.00414c1c
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x88
call fcn.00424830
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r8, rax
lea r9, [0x004ee650]
lea rdx, [rbp - 0x60]
call fcn.00414e30
xor edx, edx
lea rcx, [rbp + 0x34]
mov r8d, pe_nt_image_headers64
call fcn.00424830
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x58]
call fcn.00424830
mov r8d, dword [0x004e1f20]
lea rcx, [rsp + 0x30]
mov rdx, qword [0x004e1f18]
add r8d, r8d
mov byte [rbp - 0x68], r15b
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
call fcn.00460f78
mov r8d, ebx
lea rdx, [0x004e306c]
lea rcx, [rsp + 0x30]
call fcn.00460f78
mov r8d, ebx
lea rdx, [0x004eeb20]
lea rcx, [rsp + 0x30]
call fcn.00460f78
lea rcx, [rbp + 0x30]
mov dword [rbp + 0x30], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x415960
mov r8d, ebx
lea rdx, [rbp + 0x3c]
lea rcx, [rsp + 0x30]
call fcn.00460f78
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x60]
call fcn.00415410
mov rcx, qword [0x004e30d8]
lea rdx, str.Filename____:
call fcn.00423b70
test rax, rax
je 0x415a28
lea rdx, [0x00490974]
mov rcx, rax
call fcn.00423b70
mov r14, rax
test rax, rax
je 0x415a28
lea rcx, [rsp + 0x30]
call fcn.0046105c
or rbx, 0xffffffffffffffff
cmp byte [rbp - 0x68], r15b
je 0x415a02
mov edi, r15d
lea rsi, [rbp - 0x78]
movzx r8d, byte [rsi]
lea ecx, [rdi + rdi]
mov eax, ecx
lea r9, [0x00486270]
add rax, 0xab8
mov dword [rsp + 0x20], r8d
mov edx, 0x27
mov r8, rbx
sub edx, ecx
lea rcx, [r12 + rax*2]
call fcn.004020a8
inc edi
inc rsi
cmp edi, 0x10
jb 0x4159c0
mov word [0x004e3050], r15w
jmp 0x415a0a
mov word [0x004e3010], r15w
lea rdx, [0x004e3010]
inc rbx
cmp word [rdx + rbx*2], r15w
jne 0x415a11
lea r8, [rbx + rbx]
lea rcx, [r14 + 2]
call fcn.00424180
lea rcx, [rsp + 0x30]
call fcn.00460f44
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x415a54
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x420
mov rdi, qword [rcx + 8]
xor ebx, ebx
test rdi, rdi
je 0x415b14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415a8f
shr al, 4
and al, 1
mov bl, al
jmp 0x415b14
or r9, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov r8, rdi
mov edx, 0x200
call fcn.00435528
movzx eax, word [rsp + 0x20]
lea rdi, [rsp + 0x20]
test ax, ax
je 0x415af1
mov ebp, 0x5c
cmp ax, bp
jne 0x415ae5
lea rcx, [rsp + 0x20]
mov word [rdi], bx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x415ae2
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x415b14
mov word [rdi], bp
add rdi, 2
movzx eax, word [rdi]
test ax, ax
jne 0x415ab9
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x415b12
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x415b14
mov bl, 1
lea r11, [rsp + 0x420]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret