joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002bb04
Capabilities:
Check os version

Disassembly:
sub rsp, 0x4e8
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
test eax, eax
je 0x14002bb94
cmp dword [rsp + 0x24], 6
jne 0x14002bb89
mov eax, dword [rsp + 0x28]
cmp eax, 1
jne 0x14002bb55
cmp byte [rsp + 0x13a], al
setne cl
lea eax, [rcx + 1]
jmp 0x14002bb71
cmp eax, 2
jne 0x14002bb6a
cmp byte [rsp + 0x13a], 1
setne cl
lea eax, [rcx + 3]
jmp 0x14002bb71
jbe 0x14002bb90
mov eax, 5
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.140022430
add rsp, 0x4e8
ret
cmp dword [rsp + 0x24], 7
jae 0x14002bb6c
xor eax, eax
jmp 0x14002bb71
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Failed_to_retrieve_version_information_about_the_current_operation_system.
mov edx, 0xf
mov r8d, eax
lea rcx, [rsp + 0x140]
call fcn.14002b358
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x140]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14002bbcc
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x24]
xor edx, edx
lea r8d, [rdx + 0x2c]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x20]
add rsp, 0x58
ret

Function at 0x14002d95c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x400
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
cmp qword [rcx + 0x18], 8
mov rsi, r8
mov dil, dl
mov rbx, rcx
jb 0x14002d993
mov rcx, qword [rcx]
lea r8, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14002d9b2
cmp dword [rsp + 0x30], 0xffffffff
je 0x14002d9b2
test byte [rsp + 0x30], 0x10
jne 0x14002d9d5
cmp qword [rbx + 0x18], 8
jb 0x14002d9be
mov rcx, qword [rbx]
jmp 0x14002d9c1
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14002d9d5
test dil, dil
jne 0x14002d9fc
jmp 0x14002d9d7
mov al, 1
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.140022430
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.CreateDirectory_failed_for_directory:__s
mov qword [rsp + 0x20], rbx
mov r8d, eax
lea rcx, [rsp + 0x60]
mov edx, 0xf
call fcn.14002b114
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14002da34
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x3f0
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
cmp qword [rcx + 0x18], 8
mov dil, dl
mov rbx, rcx
jb 0x14002da63
mov rcx, qword [rcx]
lea r8, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14002daa0
cmp dword [rsp + 0x20], 0xffffffff
je 0x14002daa0
test byte [rsp + 0x20], 0x10
je 0x14002daa0
cmp qword [rbx + 0x18], 8
jb 0x14002da8c
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14002daa0
test dil, dil
jne 0x14002dac3
jmp 0x14002daa2
mov al, 1
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.140022430
mov rbx, qword [rsp + 0x408]
add rsp, 0x3f0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.failed_to_delete_directory
mov edx, 0xf
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.140018c30
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14002daf4
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x3d0
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
cmp qword [rcx + 0x18], 8
mov dil, dl
mov rbx, rcx
jb 0x14002db23
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002db77
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14002db77
cmp eax, 5
jne 0x14002db6a
mov r8b, dil
lea edx, [rax + 0x7b]
mov rcx, rbx
call fcn.14002eaa0
cmp qword [rbx + 0x18], 8
jb 0x14002db57
mov rcx, qword [rbx]
jmp 0x14002db5a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002db77
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002db77
test dil, dil
jne 0x14002db9a
xor al, al
jmp 0x14002db79
mov al, 1
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140022430
mov rbx, qword [rsp + 0x3e8]
add rsp, 0x3d0
pop rdi
ret
lea r9, str.failed_to_delete_file__s
mov qword [rsp + 0x20], rbx
mov r8d, eax
lea rcx, [rsp + 0x30]
mov edx, 0xf
call fcn.14002ca24
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14002dbcc
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov bl, dl
mov rdi, rcx
call fcn.14002d3f4
test bl, bl
mov rcx, rdi
sete dl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14002da34
Function at 0x14002eaa0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x3e0
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
cmp qword [rcx + 0x18], 8
mov dil, r8b
mov rbx, rcx
mov dword [rsp + 0x30], edx
jb 0x14002ead3
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14002eae2
test dil, dil
jne 0x14002eb03
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.140022430
mov rbx, qword [rsp + 0x400]
add rsp, 0x3e0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Cannot_set_file__s_attbutes_to__u
mov edx, 0xf
mov r8d, eax
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call fcn.14002cadc
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x140030784
Capabilities:
Copy file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x3f0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdx
cmp qword [rdx + 0x18], 8
jb 0x1400307c3
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x1400307cd
mov rcx, qword [rcx]
xor esi, esi
test r8b, r8b
sete sil
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140030872
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140030837
mov r8b, 1
lea edx, [rax + 0x7b]
mov rcx, rbx
call fcn.14002eaa0
cmp qword [rbx + 0x18], 8
jb 0x14003080c
mov rdx, qword [rbx]
jmp 0x14003080f
mov rdx, rbx
cmp qword [rdi + 0x18], 8
jb 0x14003081b
mov rcx, qword [rdi]
jmp 0x14003081e
mov rcx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140030872
jmp 0x140030837
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, str.Failed_to_copy_file_src:__s__dest:__s
mov edx, 0xf
lea rcx, [rsp + 0x50]
call fcn.14002faa4
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.140022430
add rsp, 0x3f0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140030ec4
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x510]
sub rsp, 0x610
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rbp + 0x500], rax
mov r14, r9
mov al, r8b
mov rsi, rdx
mov rdi, rcx
cmp qword [rdx + 0x18], 8
jb 0x140030f09
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x140030f13
mov rcx, qword [rcx]
xor ebx, ebx
mov r8d, ebx
test al, al
sete r8b
lea r9, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x140030f68
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
lea r9, str.Cannot_get_temp_file_name_in_path__s_with_prefix__s
mov r8d, eax
lea edx, [rbx + 0xf]
lea rcx, [rsp + 0x60]
call fcn.14002fc70
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
cmp word [rbp + 0x2f0], bx
je 0x140030f9b
lea rcx, [rbp + 0x2f0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140030f8f
mov rbx, rax
mov r8, rbx
lea rdx, [rbp + 0x2f0]
lea rcx, [rsp + 0x38]
call fcn.1400083f8
nop
lea rax, [rsp + 0x38]
cmp r14, rax
je 0x140030fd5
xor r8d, r8d
mov dl, 1
mov rcx, r14
call fcn.140007eb8
lea rdx, [rsp + 0x38]
mov rcx, r14
call fcn.140007c60
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x38]
call fcn.140007eb8
mov rcx, qword [rbp + 0x500]
xor rcx, rsp
call fcn.140022430
add rsp, 0x610
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400310b0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
and dword [rsp + 0x40], 0
mov rsi, rdx
mov rbx, rcx
call fcn.14002a2a4
test al, al
jne 0x1400310d7
xor al, al
jmp 0x14003112c
cmp qword [rbx + 0x18], 8
jb 0x1400310e3
mov rcx, qword [rbx]
jmp 0x1400310e6
mov rcx, rbx
lea rdx, [rsp + 0x40]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test eax, eax
je 0x1400310d3
mov edx, edi
mov rcx, rsi
call fcn.140022114
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
neg rax
sbb r9, r9
and r9, qword [rsi]
cmp qword [rbx + 0x18], 8
jb 0x14003111a
mov rbx, qword [rbx]
mov r8d, edi
xor edx, edx
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400312ec
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x338]
sub rsp, 0x420
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov rbx, rdx
mov rdi, rcx
mov esi, 8
call fcn.1400326f8
xor r14d, r14d
test al, al
jne 0x1400313e6
mov rcx, rbx
call fcn.1400326f8
test al, al
jne 0x1400313e6
lea eax, [rsi - 1]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
mov r8b, 1
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400322ac
mov r8b, 1
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1400322ac
nop
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r9, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x68]
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140012c50
nop
lea ecx, [rsi + 2]
test eax, eax
cmovne esi, ecx
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x38]
call fcn.140007eb8
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.140007eb8
or esi, 1
cmp qword [rbx + 0x18], 8
jb 0x1400313f5
mov rdx, qword [rbx]
jmp 0x1400313f8
mov rdx, rbx
cmp qword [rdi + 0x18], 8
jb 0x140031404
mov rcx, qword [rdi]
jmp 0x140031407
mov rcx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140031491
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140031458
mov r8b, 1
lea edx, [rax + 0x7b]
mov rcx, rbx
call fcn.14002eaa0
cmp qword [rbx + 0x18], 8
jb 0x140031439
mov rdx, qword [rbx]
jmp 0x14003143c
mov rdx, rbx
cmp qword [rdi + 0x18], 8
jb 0x140031448
mov rcx, qword [rdi]
jmp 0x14003144b
mov rcx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140031491
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, str.Failed_to_move_file_src:__s__dst:__s
mov edx, 0xf
lea rcx, [rbp - 0x80]
call fcn.14002f9e4
lea rdx, [0x1401e5908]
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.140022430
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400314b8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x328]
sub rsp, 0x410
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x38], esi
mov rcx, qword [rcx + 0x30]
cmp rcx, 0xffffffffffffffff
jne 0x14003152b
lea r8, str.trying_to_read_from_a_file_thats_not_open
lea edx, [rsi + 0x15]
lea rcx, [rsp + 0x70]
call fcn.140008aa8
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov r14d, 7
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
jmp 0x140031583
cmp dword [rsp + 0x34], 2
jne 0x140031625
movzx r8d, word [rsp + 0x30]
cmp r8w, 0xa
je 0x140031625
cmp r8w, 0xd
je 0x1400315ab
mov eax, 0xfeff
cmp r8w, ax
je 0x14003157f
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400081b0
mov rcx, qword [rdi + 0x30]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x34], esi
lea r9, [rsp + 0x34]
mov r8d, 2
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140031542
jmp 0x140031634
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x34]
mov r8d, 2
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14003160a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x140031625
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, str.read_from_file_failed
mov edx, 0xf
lea rcx, [rsp + 0x70]
call fcn.140018a20
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
cmp word [rsp + 0x30], 0xa
je 0x140031625
mov rdx, 0xfffffffffffffffe
lea r8d, [rdx + 3]
mov rcx, rdi
call fcn.140031814
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 8
jmp 0x14003164b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x14003167a
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x10], rsi
cmp r14, 8
jb 0x140031652
mov rax, qword [rbx]
jmp 0x140031655
mov rax, rbx
mov word [rax], si
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140007c60
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140007eb8
mov rax, rbx
jmp 0x1400316ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, str.read_from_file_failed
mov edx, 0xf
lea rcx, [rsp + 0x70]
call fcn.140018a20
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140022430
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400316d4
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov rdi, rcx
mov eax, 7
mov qword [rbp - 0x30], rax
xor esi, esi
mov qword [rbp - 0x38], rsi
mov word [rbp - 0x48], si
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], rsi
mov word [rbp - 0x28], si
lea r8d, [rax - 4]
lea rdx, [0x14019af60]
lea rcx, [rbp - 0x28]
call fcn.1400083f8
nop
lea r9, [rbp - 0x48]
mov r8b, 1
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.140030ec4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x28]
call fcn.140007eb8
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
cmp qword [rdi + 0x18], 8
jb 0x140031771
mov rcx, qword [rdi]
jmp 0x140031774
mov rcx, rdi
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
lea rcx, [rbp - 0x48]
jne 0x14003178b
mov rcx, rdi
call fcn.1400317c0
mov bl, al
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x48]
call fcn.140007eb8
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140022430
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400317c0
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x1400317d2
mov rcx, qword [rcx]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140031809
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0x30]
mov r8, rbx
lea rdx, str.Failed_to_schedule_delete_file__s.__Error_Code:_0x_x.
mov dword [rsp + 0x30], eax
mov ecx, 2
call fcn.14003046c
xor al, al
jmp 0x14003180b
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140031e50
Capabilities:
Parse url

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov edi, 0x68
mov r8d, edi
lea rcx, [rbp - 0x49]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x49], edi
lea rcx, [rbp + 0x27]
xor edi, edi
mov qword [rbp + 0x3f], 7
or r9, 0xffffffffffffffff
mov qword [rbp + 0x37], rdi
xor r8d, r8d
mov word [rbp + 0x27], di
mov rdx, rbx
call fcn.1400082c0
cmp qword [rbp + 0x3f], 8
lea rcx, [rbp + 0x27]
lea r9, [rbp - 0x49]
cmovae rcx, qword [rbp + 0x27]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x140031ee8
mov ecx, dword [rbp - 0x35]
lea ebx, [rdi + 3]
sub ecx, ebx
je 0x140031f22
sub ecx, 1
je 0x140031f1b
cmp ecx, 1
je 0x140031eea
mov ebx, edi
xor r8d, r8d
lea rcx, [rbp + 0x27]
mov dl, 1
call fcn.140007eb8
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140022430
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ebx, 2
jmp 0x140031eea
mov ebx, 1
jmp 0x140031eea
Function at 0x140032078
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x5e0
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rsp + 0x5d0], rax
mov rsi, rdx
mov ebx, ecx
xor edi, edi
lea rcx, [rsp + 0x3c2]
xor edx, edx
mov word [rsp + 0x3c0], di
mov r8d, 0x206
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x3c0]
xor r8d, r8d
lea r9d, [rdi + 1]
mov qword [rsp + 0x20], rax
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, 0x80070057
je 0x14003213f
cmp word [rsp + 0x3c0], di
je 0x140032107
lea rcx, [rsp + 0x3c0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x1400320fb
mov rdi, rax
mov r8, rdi
lea rdx, [rsp + 0x3c0]
mov rcx, rsi
call fcn.1400083f8
mov rcx, qword [rsp + 0x5d0]
xor rcx, rsp
call fcn.140022430
lea r11, [rsp + 0x5e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea r8, str.Invalid_csidl_is_passed_to_SHGetFolerPath
mov edx, 0x1d
lea rcx, [rsp + 0x30]
call fcn.140031bb0
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1400379f8
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 8], 0
mov al, r8b
mov r9, rdx
mov rdi, rcx
je 0x140037a34
lea r8, [rcx + 0x20]
mov ecx, 3
lea rdx, str.Mutex__s_already_created
call fcn.1400252e8
mov al, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rbx, [rcx + 0x20]
cmp qword [rbx + 0x18], 8
jb 0x140037a44
mov r8, qword [rbx]
jmp 0x140037a47
mov r8, rbx
movzx edx, al
lea rcx, [r9 + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi + 8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
cmp eax, 0xb7
jne 0x140037a7d
mov r8, rbx
lea rdx, str.Got_handle_to_existing_mutex__s
mov ecx, 3
call fcn.140025340
cmp qword [rdi + 8], 0
jne 0x140037a27
lea r9, [rsp + 0x30]
mov r8, rbx
lea rdx, str.Failed_to_create_the_mutex__s:_LastError:_0x_x
mov ecx, 3
call fcn.140035fc4
xor al, al
jmp 0x140037a29
Function at 0x14003bc98
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x3c0
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
cmp qword [rcx + 8], 0
mov sil, dl
mov rdi, rcx
je 0x14003bd05
lea r8, [rcx + 0x20]
mov ecx, 3
lea rdx, str.Mutex__s_already_opened
call fcn.140025290
mov al, 1
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.140022430
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rbx, [rcx + 0x20]
cmp qword [rbx + 0x18], 8
jb 0x14003bd15
mov r8, qword [rbx]
jmp 0x14003bd18
mov r8, rbx
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rdi + 8], rax
test rax, rax
jne 0x14003bcde
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14003bd42
test sil, sil
jne 0x14003bd49
xor al, al
jmp 0x14003bce0
test sil, sil
je 0x14003bd3e
jmp 0x14003bd74
mov r9, rbx
lea r8, str.Attempting_to_open_mutex__s_which_does_not_yet_exist
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140033e0c
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Failed_to_open_mutex
mov edx, 0x63
mov r8d, eax
lea rcx, [rsp + 0x20]
call fcn.14002f8c0
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14003c300
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x3d0
mov rax, qword [0x140198858]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
cmp qword [rcx + 8], 0xffffffffffffffff
mov rdi, rdx
mov rbx, rcx
je 0x14003c337
xor edx, edx
call fcn.14002c310
test al, al
je 0x14003c397
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14003c347
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rbx + 0x20]
lea rax, [rbx + 0x2c]
mov qword [rsp + 0x28], rax
mov r9, rdi
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
je 0x14003c3bf
mov dword [rbx + 0x28], 0x103
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140022430
mov rbx, qword [rsp + 0x3f0]
add rsp, 0x3d0
pop rdi
ret
lea r8, str.Attempting_to_start_a_new_thread_when_the_thread_has_already_been_started
mov edx, 0x53
lea rcx, [rsp + 0x30]
call fcn.140033ff0
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Failed_to_start_thread.
mov edx, 0xf
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.140023a24
lea rdx, [0x1401e5908]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3