joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad490
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
cmp ecx, 2
je 0x4ad4c0
cmp ecx, 0xe
jne 0x4ad4e0
mov rax, qword [0x005ee990]
test rax, rax
je 0x4ad4e9
cmp rax, 1
je 0x4ad4b7
mov ecx, 0xe
call rax
xor eax, eax
add rsp, 0x28
ret
mov rax, qword [0x005ee988]
test rax, rax
je 0x4ad515
cmp rax, 1
je 0x4ad4b7
mov ecx, 2
call rax
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x5704c8
mov ecx, 2
call fcn.004b4e00
test eax, eax
jne 0x4ad533
lea rcx, str.compat_mingw.c
mov r8d, 0x8e
mov edx, 0xaf1
call fcn.00480ea0
mov ecx, eax
call sub.msvcrt.dll_exit
lea rcx, str.compat_mingw.c
mov r8d, 0x82
mov edx, 0xaf8
call fcn.00480ea0
mov ecx, eax
call sub.msvcrt.dll_exit
mov ecx, 2
call qword [fcn.005707a0]
mov r8d, 0xc
mov edx, 1
lea rcx, str.Alarm_clock_n
mov r9, rax
call sub.msvcrt.dll_fwrite
jmp 0x4ad4f7
jmp qword [sym.imp.msvcrt.dll_raise]

Function at 0x4adc30
Capabilities:
Set environment variable

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x28
mov r13, rcx
call sub.msvcrt.dll_strlen
mov edx, 2
lea r14d, [rax + rax + 1]
movsxd rbx, r14d
mov rcx, rbx
call fcn.004c8f80
mov r12, rax
test rax, rax
je 0x4add00
mov rdx, r13
mov rcx, rax
mov r9d, 0xffffffff
mov r8, rbx
call fcn.004ad7d0
mov edx, 0x3d
mov rcx, r12
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x4adcf0
xor edx, edx
mov rcx, r12
mov word [rax], dx
lea rdx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r13d, eax
mov rcx, r12
call fcn.004c9260
xor eax, eax
test r13d, r13d
je 0x4adcc0
add rsp, 0x28
pop rbx
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, r12d
mov rbx, rax
call fcn.004abd60
mov dword [rbx], eax
mov eax, 0xffffffff
add rsp, 0x28
pop rbx
pop r12
pop r13
pop r14
ret
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r13d, eax
jmp 0x4adc9f
mov edx, r14d
lea rcx, str.Out_of_memory___tried_to_allocate__u_wchar_ts_
call fcn.00494770
nop
test rcx, rcx
je 0x4add1a
cmp byte [rcx], 0
jne 0x4add20
xor eax, eax
ret
jmp fcn.004adc30
Function at 0x4add10
Capabilities:
Set environment variable

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x28
mov r13, rcx
call sub.msvcrt.dll_strlen
mov edx, 2
lea r14d, [rax + rax + 1]
movsxd rbx, r14d
mov rcx, rbx
call fcn.004c8f80
mov r12, rax
test rax, rax
je 0x4add00
mov rdx, r13
mov rcx, rax
mov r9d, 0xffffffff
mov r8, rbx
call fcn.004ad7d0
mov edx, 0x3d
mov rcx, r12
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x4adcf0
xor edx, edx
mov rcx, r12
mov word [rax], dx
lea rdx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r13d, eax
mov rcx, r12
call fcn.004c9260
xor eax, eax
test r13d, r13d
je 0x4adcc0
add rsp, 0x28
pop rbx
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, r12d
mov rbx, rax
call fcn.004abd60
mov dword [rbx], eax
mov eax, 0xffffffff
add rsp, 0x28
pop rbx
pop r12
pop r13
pop r14
ret
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r13d, eax
jmp 0x4adc9f
mov edx, r14d
lea rcx, str.Out_of_memory___tried_to_allocate__u_wchar_ts_
call fcn.00494770
nop
test rcx, rcx
je 0x4add1a
cmp byte [rcx], 0
jne 0x4add20
xor eax, eax
ret
jmp fcn.004adc30

Function at 0x4addc0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x460
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsi]
mov qword [rsp + 0x458], rax
xor eax, eax
lea r13, [rsp + 0x40]
mov rbx, rcx
mov edi, edx
mov ecx, 0x104
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [rax - 1]
cmp edx, 0x102
ja 0x4adf20
mov dword [rsp + 0x28], 0x2000000
xor r9d, r9d
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x4adee0
lea r14, [rsp + 0x250]
xor r9d, r9d
mov r8d, 0x104
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov rcx, r12
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub ebp, 1
cmp ebp, 0x102
jbe 0x4ade9a
mov rdx, r14
mov r8d, 0x104
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea edx, [rax - 1]
cmp edx, 0x102
ja 0x4adf20
mov rcx, r14
call fcn.004ab060
movsxd r8, edi
mov rcx, rbx
mov rdx, rax
call fcn.004add30
test eax, eax
js 0x4adf40
mov rax, rbx
mov rdi, qword [rsp + 0x458]
xor rdi, qword [rsi]
jne 0x4adf61
add rsp, 0x460
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movsxd r8, edi
mov rdx, r13
mov rcx, rbx
call fcn.004add30
test eax, eax
js 0x4adf40
movzx edx, byte [rbx]
test dl, dl
je 0x4adeb8
mov rax, rbx
nop dword [rax]
cmp dl, 0x5c
jne 0x4adf08
mov byte [rax], 0x2f
movzx edx, byte [rax + 1]
add rax, 1
test dl, dl
jne 0x4adf00
jmp 0x4adeb8
mov ebx, 0x26
test eax, eax
je 0x4adf50
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], ebx
xor eax, eax
jmp 0x4adebb
xor eax, eax
jmp 0x4adebb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004abd60
mov ebx, eax
jmp 0x4adf29
call sub.libssp_0.dll___stack_chk_fail
nop
nop word [rax + rax]
Function at 0x4adf70
Capabilities:
Query environment variable

Disassembly:
push r14
mov eax, 0x10038
push r13
push r12
push rdi
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsi]
mov qword [rsp + 0x10028], rax
xor eax, eax
mov r13, rcx
call sub.msvcrt.dll_strlen
mov edx, 2
lea r14d, [rax + 1]
movsxd rdi, r14d
mov rcx, rdi
call fcn.004c8f80
mov r12, rax
test rax, rax
je 0x4ae0ae
mov rdx, r13
mov r9d, 0xffffffff
mov r8, rdi
mov rcx, rax
call fcn.004ad7d0
lea r13, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, 0x8000
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x4ae090
lea r14d, [rbx + rbx*2 + 1]
mov rcx, r12
call fcn.004c9260
movsxd rbx, r14d
mov edx, 1
mov rcx, rbx
call fcn.004c8f80
mov r12, rax
test rax, rax
je 0x4ae0c2
mov r8, rbx
mov rdx, r13
lea rdi, [0x005ee6e0]
mov rcx, rax
call fcn.004add30
movsxd r13, dword [0x005ee8e0]
mov rcx, qword [rdi + r13*8]
mov rbx, r13
add ebx, 1
call fcn.004c9260
cmp ebx, 0x40
mov eax, 0
mov qword [rdi + r13*8], r12
cmovae ebx, eax
mov dword [0x005ee8e0], ebx
mov rax, qword [rsp + 0x10028]
xor rax, qword [rsi]
jne 0x4ae0bd
mov rax, r12
add rsp, 0x10038
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x4adfff
mov rcx, r12
xor r12d, r12d
call fcn.004c9260
jmp 0x4ae068
mov edx, r14d
lea rcx, str.Out_of_memory___tried_to_allocate__u_wchar_ts_
call fcn.00494770
call sub.libssp_0.dll___stack_chk_fail
mov edx, r14d
lea rcx, str.Out_of_memory___tried_to_allocate__u_bytes_
call fcn.00494770
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x4ae0e0
Capabilities:
Query environment variable

Disassembly:
test rcx, rcx
je 0x4ae0f0
cmp byte [rcx], 0
je 0x4ae0f0
jmp fcn.004adf70
xor eax, eax
ret

Function at 0x4ae580
Capabilities:
Get session user name

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x100
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0xf8], rax
xor eax, eax
mov eax, dword [0x005edeb0]
test eax, eax
je 0x4ae5d0
mov rax, qword [0x005edea8]
mov rsi, qword [rsp + 0xf8]
xor rsi, qword [rbx]
jne 0x4ae685
add rsp, 0x100
pop rbx
pop rsi
pop r12
ret
lea r12, [rsp + 0x30]
mov dword [rsp + 0x2c], 0x64
lea rdx, [rsp + 0x2c]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x4ae660
mov r8d, 0x64
mov rdx, r12
lea rcx, [0x005ede40]
call fcn.004add30
test eax, eax
js 0x4ae660
mov ecx, 0x18
call fcn.004996e0
mov ecx, 3
mov rsi, rax
mov qword [0x005edea8], rax
lea rax, [0x005ede40]
mov qword [rsi], rax
call fcn.004ae440
mov qword [rsi + 8], rax
mov rax, qword [0x005edea8]
cmp qword [rax + 8], 0
je 0x4ae678
mov qword [rax + 0x10], 0
mov dword [0x005edeb0], 1
jmp 0x4ae5b0
mov dword [0x005edeb0], 1
xor eax, eax
jmp 0x4ae5b0
lea rcx, str.unknown
mov qword [rax + 8], rcx
jmp 0x4ae642
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax + rax]
Function at 0x4af110
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get common file path
Read file on windows
Timestomp file

Disassembly:
push r14
mov eax, 0x2030
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rbp, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r13, rcx
mov edi, edx
mov ebx, r8d
mov esi, r9d
mov rax, qword [rbp]
mov qword [rsp + 0x2028], rax
xor eax, eax
cmp edx, 1
jle 0x4af160
movzx eax, word [rcx]
cmp eax, 0x5c
je 0x4af170
cmp eax, 0x2f
je 0x4af170
cmp word [rcx + 2], 0x3a
je 0x4af170
mov eax, dword [0x005ee9b8]
add eax, edi
cmp eax, ebx
jl 0x4af1f8
lea r14, [rsp + 0x20]
xor r9d, r9d
mov edx, 0x1000
mov rcx, r13
mov r8, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov r12d, eax
test eax, eax
je 0x4af25d
cmp ebx, eax
jg 0x4af250
test esi, esi
je 0x4af284
cmp eax, 0xff9
jg 0x4af284
cmp word [rsp + 0x20], 0x5c
jne 0x4af228
cmp word [rsp + 0x22], 0x5c
jne 0x4af1d0
movzx eax, word [rsp + 0x24]
cmp ax, 0x3f
je 0x4af1f8
cmp ax, 0x2e
je 0x4af1f8
lea rdx, str._UNC_
mov rcx, r13
add r12d, 6
call sub.msvcrt.dll_wcscpy
lea rdx, [rsp + 0x24]
lea rcx, [r13 + 0x10]
call sub.msvcrt.dll_wcscpy
jmp 0x4af1fb
mov r12d, edi
mov rax, qword [rsp + 0x2028]
xor rax, qword [rbp]
jne 0x4af29b
mov eax, r12d
add rsp, 0x2030
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdx, [0x0058faea]
mov rcx, r13
add r12d, 4
call sub.msvcrt.dll_wcscpy
lea rcx, [r13 + 8]
mov rdx, r14
call sub.msvcrt.dll_wcscpy
jmp 0x4af1fb
mov rdx, r14
mov rcx, r13
call sub.msvcrt.dll_wcscpy
jmp 0x4af1fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, r12d
mov r12d, 0xffffffff
mov rbx, rax
call fcn.004abd60
mov dword [rbx], eax
jmp 0x4af1fb
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x26
jmp 0x4af1fb
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x4af2b0
Capabilities:
Create directory
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push r13
mov eax, 0x2038
push r12
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r9d, 0xffffffff
mov r8d, 0x1000
mov esi, dword [0x00605de8]
mov rax, qword [rbx]
mov qword [rsp + 0x2028], rax
xor eax, eax
lea r13, [rsp + 0x20]
mov r12d, edx
mov rdx, rcx
mov rcx, r13
call fcn.004ad7d0
mov edx, eax
test eax, eax
js 0x4af340
mov r9d, esi
mov r8d, 0x104
mov rcx, r13
call fcn.004af110
test eax, eax
js 0x4af34e
mov edx, r12d
mov rcx, r13
call qword [sym.imp.msvcrt.dll__wchmod]
mov rsi, qword [rsp + 0x2028]
xor rsi, qword [rbx]
jne 0x4af362
add rsp, 0x2038
pop rbx
pop rsi
pop r12
pop r13
ret
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
cmp dword [rax], 0x22
je 0x4af358
mov eax, 0xffffffff
jmp 0x4af323
call rsi
mov dword [rax], 0x26
jmp 0x4af34e
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax + rax]
Function at 0x4af370
Capabilities:
Create directory
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push r12
mov eax, 0x2038
push rdi
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r9d, 0xffffffff
mov r8d, 0x1000
mov edi, dword [0x00605de8]
mov rax, qword [rsi]
mov qword [rsp + 0x2028], rax
xor eax, eax
lea r12, [rsp + 0x20]
mov ebx, edx
mov rdx, rcx
mov rcx, r12
call fcn.004ad7d0
mov edx, eax
test eax, eax
js 0x4af400
mov r9d, edi
mov r8d, 0x104
mov rcx, r12
call fcn.004af110
test eax, eax
js 0x4af40e
and ebx, 0xfffffffe
mov rcx, r12
mov edx, ebx
call qword [sym.imp.msvcrt.dll__waccess]
mov rdi, qword [rsp + 0x2028]
xor rdi, qword [rsi]
jne 0x4af422
add rsp, 0x2038
pop rbx
pop rsi
pop rdi
pop r12
ret
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x4af418
mov eax, 0xffffffff
jmp 0x4af3e3
call rbx
mov dword [rax], 0x26
jmp 0x4af40e
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax + rax]
Function at 0x4af430
Capabilities:
Create directory
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push r13
mov eax, 0x2048
push r12
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
xor edx, edx
mov rax, qword [rsi]
mov qword [rsp + 0x2038], rax
xor eax, eax
mov rbx, rcx
call fcn.004aed50
test eax, eax
je 0x4af638
lea r13, [rsp + 0x30]
mov rdx, rbx
mov r9d, 0xffffffff
mov r8d, 0x1000
mov rcx, r13
mov r12d, dword [0x00605de8]
call fcn.004ad7d0
mov edx, eax
test eax, eax
js 0x4af580
mov r9d, r12d
mov r8d, 0xf8
mov rcx, r13
call fcn.004af110
test eax, eax
js 0x4af596
mov rcx, r13
call qword [sym.imp.msvcrt.dll__wmkdir]
mov r12d, eax
test eax, eax
je 0x4af4e8
mov rax, qword [rsp + 0x2038]
xor rax, qword [rsi]
jne 0x4af64f
mov eax, r12d
add rsp, 0x2048
pop rbx
pop rsi
pop r12
pop r13
ret
call fcn.004ac230
mov eax, dword [0x005765dc]
mov qword [rsp + 0x28], rbx
test eax, eax
je 0x4af4bf
lea rcx, [rsp + 0x28]
call fcn.004b55a0
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx]
test al, al
je 0x4af4bf
mov rbx, rcx
jmp 0x4af53a
mov rdx, rcx
cmp r8d, 0x5c
je 0x4af542
lea rcx, [rdx + 1]
mov qword [rsp + 0x28], rcx
movzx eax, byte [rdx + 1]
test al, al
je 0x4af5a8
movsx r8d, al
cmp al, 0x2f
jne 0x4af520
add rcx, 1
nop word cs:[rax + rax]
mov qword [rsp + 0x28], rcx
movsx r8d, byte [rcx]
mov rdx, rcx
lea rcx, [rcx + 1]
cmp r8b, 0x2f
je 0x4af550
cmp r8d, 0x5c
je 0x4af550
test r8b, r8b
je 0x4af5a8
mov rbx, rdx
jmp 0x4af529
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
jne 0x4af596
call rbx
mov dword [rax], 0x26
mov r12d, 0xffffffff
jmp 0x4af4bf
mov eax, dword [0x005765dc]
cmp eax, 1
je 0x4af628
cmp eax, 2
jne 0x4af608
mov r8d, 4
mov rdx, rbx
lea rcx, str..git
call qword [sym.imp.msvcrt.dll__strnicmp_2]
test eax, eax
jne 0x4af4bf
movzx eax, byte [rbx + 4]
test al, al
je 0x4af5f0
movsx edx, al
cmp al, 0x2f
je 0x4af5f0
cmp edx, 0x5c
jne 0x4af4bf
nop
mov edx, 1
mov rcx, r13
call fcn.004ac300
mov r12d, eax
jmp 0x4af4bf
mov r8d, 0x25d
lea rdx, str.compat_mingw.c
lea rcx, str.hide_dotfiles__HIDE_DOTFILES_DOTGITONLY
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x4af5b8
cmp byte [rbx], 0x2e
je 0x4af5f0
jmp 0x4af4bf
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x16
jmp 0x4af4bf
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
Function at 0x4af660
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push r14
mov eax, 0x4030
push r13
push r12
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r9d, 0xffffffff
mov r8d, 0x1000
mov r12d, dword [0x00605de8]
mov rax, qword [rbx]
mov qword [rsp + 0x4028], rax
xor eax, eax
lea r13, [rsp + 0x20]
mov r14, rdx
mov rdx, rcx
mov rcx, r13
call fcn.004ad7d0
mov edx, eax
test eax, eax
js 0x4af748
mov r9d, r12d
mov r8d, 0x104
mov rcx, r13
call fcn.004af110
test eax, eax
js 0x4af756
mov rdx, r14
lea r12, [rsp + 0x2020]
mov r9d, 0xffffffff
mov r8d, 0x1000
mov rcx, r12
mov esi, dword [0x00605de8]
call fcn.004ad7d0
mov edx, eax
test eax, eax
js 0x4af748
mov r9d, esi
mov r8d, 0x104
mov rcx, r12
call fcn.004af110
test eax, eax
js 0x4af756
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
test eax, eax
je 0x4af76f
xor eax, eax
mov rsi, qword [rsp + 0x4028]
xor rsi, qword [rbx]
jne 0x4af78d
add rsp, 0x4030
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
cmp dword [rax], 0x22
je 0x4af760
mov eax, 0xffffffff
jmp 0x4af727
call rsi
mov dword [rax], 0x26
mov eax, 0xffffffff
jmp 0x4af727
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, r12d
mov rsi, rax
call fcn.004abd60
mov dword [rsi], eax
jmp 0x4af756
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop
Function at 0x4af7a0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Get common file path
Read file on windows
Timestomp file

Disassembly:
push r13
mov eax, 0x2280
push r12
push rdi
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r9d, 0xffffffff
mov r8d, 0x1000
mov rax, qword [rbx]
mov qword [rsp + 0x2278], rax
xor eax, eax
mov rsi, rcx
lea r12, [rsp + 0x20]
mov ecx, 0x4a
mov rdx, qword [rsi + 0x10]
mov rdi, r12
lea r13, [rsp + 0x270]
rep stosq qword [rdi], rax
mov rcx, r13
mov edi, dword [0x00605de8]
call fcn.004ad7d0
mov edx, eax
test eax, eax
js 0x4af8a8
mov r9d, edi
mov r8d, 0x104
mov rcx, r13
call fcn.004af110
test eax, eax
js 0x4af8b6
jne 0x4af870
mov rcx, r13
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x4af848
call qword [sym.imp.KERNEL32.dll_FindClose]
test byte [rsp + 0x21], 4
jne 0x4af890
xor eax, eax
mov rsi, qword [rsp + 0x2278]
xor rsi, qword [rbx]
jne 0x4af8f3
add rsp, 0x2280
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
sub eax, 1
cdqe
cmp word [rsp + rax*2 + 0x270], 0x2f
jne 0x4af826
xor edx, edx
mov word [rsp + rax*2 + 0x270], dx
jmp 0x4af826
cmp dword [rsp + 0x44], 0xa0000003
mov eax, 1
jne 0x4af848
jmp 0x4af84a
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x4af8d8
mov r12, qword [rsi + 0x10]
call fcn.00426640
lea rcx, [0x00590b47]
test eax, eax
je 0x4af8e2
mov rdx, r12
call fcn.00494770
nop word [rax + rax]
call rbx
mov dword [rax], 0x26
jmp 0x4af8b6
lea rcx, str.could_not_get_long_path_for__s
call fcn.0056e6a8
mov rcx, rax
jmp 0x4af8ca
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax]
Function at 0x4af900
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push r14
mov eax, 0x2040
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r9d, 0xffffffff
mov r8d, 0x1000
mov ebp, dword [0x00605de8]
mov rax, qword [rdi]
mov qword [rsp + 0x2038], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rdx, rcx
mov rsi, rcx
mov rcx, rbx
mov dword [rsp + 0x2c], 0
call fcn.004ad7d0
mov edx, eax
test eax, eax
js 0x4afa20
mov r9d, ebp
mov r8d, 0x104
mov rcx, rbx
call fcn.004af110
test eax, eax
js 0x4af9c3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4afa18
mov r12, qword [sym.imp.msvcrt.dll__wchmod]
mov rbp, qword [sym.imp.msvcrt.dll__wunlink]
lea r14, [rsp + 0x2c]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, 0x1b6
call r12
mov rcx, rbx
call rbp
test eax, eax
je 0x4afa18
call r13
cmp eax, 5
je 0x4af9f0
cmp eax, 0x20
je 0x4af9f0
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x2038]
xor rsi, qword [rdi]
jne 0x4afa3d
add rsp, 0x2040
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wrmdir]
test eax, eax
je 0x4afa18
mov r8, rsi
lea rdx, str.Unlink_of_file__s_failed._Should_I_try_again_
mov rcx, r14
call fcn.004ae3a0
test eax, eax
jne 0x4af9a2
jmp 0x4af9c3
xor eax, eax
jmp 0x4af9c8
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
jne 0x4af9c3
call rbx
mov dword [rax], 0x26
mov eax, 0xffffffff
jmp 0x4af9c8
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop

Function at 0x4afa50
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Get common file path
Read file on windows
Timestomp file

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x238
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r9d, 0xffffffff
mov r8d, 0x104
mov rax, qword [rdi]
mov qword [rsp + 0x228], rax
xor eax, eax
lea rsi, [rsp + 0x20]
mov rdx, rcx
mov r12, rcx
mov rcx, rsi
call fcn.004ad7d0
mov edx, eax
test eax, eax
js 0x4afb48
xor r9d, r9d
mov r8d, 0x104
mov rcx, rsi
call fcn.004af110
test eax, eax
js 0x4afb56
movsx eax, byte [r12]
cmp eax, 0x2f
je 0x4afb10
cmp eax, 0x5c
je 0x4afb10
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wmktemp]
test rax, rax
je 0x4afb56
mov rcx, r12
call sub.msvcrt.dll_strlen
lea rdx, [rsi + rbx*2]
mov rcx, r12
lea r8, [rax + 1]
call fcn.004add30
test eax, eax
js 0x4afb56
mov rax, qword [rsp + 0x228]
xor rax, qword [rdi]
jne 0x4afb6d
mov rax, r12
add rsp, 0x238
pop rbx
pop rsi
pop rdi
pop r12
ret
movsx eax, byte [r12 + 1]
cmp eax, 0x2f
je 0x4afac1
cmp eax, 0x5c
je 0x4afac1
movzx ecx, word [rsp + 0x20]
mov edx, 0x103
call sub.msvcrt.dll_iswctype
test eax, eax
je 0x4afac1
cmp word [rsp + 0x22], 0x3a
jne 0x4afac1
mov ebx, 2
jmp 0x4afac3
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x4afb60
xor r12d, r12d
jmp 0x4afaf1
call rbx
xor r12d, r12d
mov dword [rax], 0x26
jmp 0x4afaf1
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop
Function at 0x4afb80
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x250
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r9d, 0xffffffff
mov r8d, 0x104
mov rax, qword [rsi]
mov qword [rsp + 0x248], rax
xor eax, eax
lea r12, [rsp + 0x40]
mov rbx, rcx
mov rcx, r12
call fcn.004ad7d0
mov edx, eax
test eax, eax
js 0x4afc90
xor r9d, r9d
mov r8d, 0x104
mov rcx, r12
call fcn.004af110
test eax, eax
js 0x4afcb0
mov dword [rsp + 0x28], 0x2000000
xor r9d, r9d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x4afcb0
xor r9d, r9d
mov r8d, 0x104
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov rcx, r13
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub edi, 1
cmp edi, 0x102
ja 0x4afcb0
mov rcx, r12
call sub.msvcrt.dll_wcslen
mov rcx, rbx
lea edi, [rax + rax*2]
movsxd rdi, edi
mov rdx, rdi
call fcn.004727c0
mov rcx, r12
call fcn.004ab060
mov rcx, qword [rbx + 0x10]
mov r8, rdi
mov rdx, rax
call fcn.004add30
test eax, eax
js 0x4afcb0
cdqe
mov qword [rbx + 8], rax
mov rax, qword [rbx + 0x10]
jmp 0x4afcb2
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
jne 0x4afcb0
call rbx
mov dword [rax], 0x26
nop word cs:[rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x248]
xor rbx, qword [rsi]
jne 0x4afcce
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop