joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006bf80
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140131048]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x14006c1af
lea rdx, [0x140105d90]
mov qword [rsp + 0x88], rdi
call fcn.140080c20
mov rdi, rax
test rax, rax
je 0x14006c1a7
mov r9, rax
mov qword [rsp + 0x80], r14
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, 0x40
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
mov r14, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14d, r14d
je 0x14006c19f
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], rsi
cmp r14d, 7
jl 0x14006c051
cmp eax, 0x66656423
jne 0x14006c051
cmp word [rsp + 0x34], 0x6e69
jne 0x14006c051
cmp byte [rsp + 0x36], 0x65
jne 0x14006c051
mov ecx, 0x50
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14006c18f
mov rdx, qword [rbx + 0x30]
mov rcx, rax
call fcn.14006c9c0
jmp 0x14006c098
cmp r14d, 9
jl 0x14006c125
movabs rcx, 0x2a204d5058202a2f
cmp rax, rcx
jne 0x14006c125
cmp byte [rsp + 0x38], 0x2f
jne 0x14006c125
mov ecx, 0x50
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14006c18f
mov rdx, qword [rbx + 0x30]
mov rcx, rax
call fcn.14006cc40
mov rbp, rax
test rax, rax
je 0x14006c18f
cmp dword [rbx + 0x48], 0
je 0x14006c0be
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14006c0be
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x18]
mov edi, dword [rbx + 8]
mov esi, dword [rbx + 0xc]
mov dword [rbx + 0x48], 1
mov qword [rbx + 0x40], rbp
test rbp, rbp
je 0x14006c172
mov eax, dword [rbp + 0x1c]
mov dword [rbx + 8], eax
mov dword [rbx + 0x1c], eax
mov eax, dword [rbp + 0x20]
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x20], eax
mov eax, dword [rbp + 0x10]
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rbp + 0x18]
mov qword [rbx + 0x28], rax
mov dword [rbx + 0x18], ecx
test edi, edi
je 0x14006c18f
test esi, esi
je 0x14006c176
mov rax, qword [rbx]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x20], 1
mov edx, edi
mov rcx, rbx
call qword [rax + 0x58]
jmp 0x14006c176
xor edi, edi
cmp dword [0x140133638], edi
jle 0x14006c18f
mov esi, edi
nop dword [rax]
nop word [rax + rax]
mov rax, qword [0x140133630]
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 0x30]
mov r8d, r14d
call qword [rsi + rax]
mov rbp, rax
test rax, rax
jne 0x14006c0a4
inc edi
add rsi, 8
cmp edi, dword [0x140133638]
jl 0x14006c140
jmp 0x14006c18f
test edi, edi
je 0x14006c18f
mov rax, qword [rbx]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x20], 1
mov edx, edi
mov rcx, rbx
call qword [rax + 0x58]
mov rbp, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400ea730
add rsp, 0x90
pop rbx
ret
Function at 0x14006e860
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
push rbp
push r12
push r13
sub rsp, 0x38
mov rax, rdx
mov rbp, rcx
mov rcx, rax
lea rdx, [0x1401085d0]
mov r13d, r9d
mov ebx, r8d
call fcn.140080c20
mov qword [rsp + 0x28], rax
mov r12, rax
test rax, rax
jne 0x14006e8a7
mov eax, 1
add rsp, 0x38
pop r13
pop r12
pop rbp
pop rbx
ret
mov qword [rsp + 0x60], rsi
mov eax, r13d
sub eax, ebx
mov qword [rsp + 0x30], r15
mov r15d, dword [rsp + 0x80]
cmp eax, r15d
mov esi, r15d
cmovle esi, eax
test esi, esi
je 0x14006e9fd
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r14
nop dword [rax]
lea r14d, [rsi + rbx]
test ebx, ebx
js 0x14006e9a4
mov edi, dword [rbp + 0x34]
cmp ebx, edi
jg 0x14006e9a4
cmp r14d, ebx
mov r13d, r14d
cmovge r13d, ebx
cmovge ebx, r14d
cmp ebx, edi
cmovle edi, ebx
mov eax, edi
sub eax, r13d
movsxd r12, eax
mov dword [rsp + 0x20], eax
lea rcx, [r12 + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15d, dword [rbp + 0x40]
mov rbx, rax
movsxd rcx, r13d
cmp edi, r15d
jg 0x14006e93f
mov rdx, qword [rbp + 0x38]
mov r8, r12
add rdx, rcx
mov rcx, rax
jmp 0x14006e986
cmp r13d, r15d
jl 0x14006e958
mov eax, dword [rbp + 0x44]
mov r8, r12
sub eax, r15d
movsxd rdx, eax
add rdx, rcx
mov rcx, rbx
jmp 0x14006e982
mov rdx, qword [rbp + 0x38]
sub r15d, r13d
add rdx, rcx
movsxd rdi, r15d
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x20]
lea rcx, [rdi + rbx]
movsxd rdx, dword [rbp + 0x44]
sub eax, r15d
movsxd r8, eax
add rdx, qword [rbp + 0x38]
call sub.VCRUNTIME140.dll_memcpy
mov r15d, dword [rsp + 0x80]
mov r13d, dword [rsp + 0x78]
mov byte [r12 + rbx], 0
mov r12, qword [rsp + 0x28]
jmp 0x14006e9b5
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov byte [rax], 0
movsxd r8, esi
mov r9, r12
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp edi, esi
jne 0x14006e9f3
mov eax, r13d
mov esi, r15d
sub eax, r14d
mov ebx, r14d
cmp eax, r15d
cmovle esi, eax
test esi, esi
jne 0x14006e8e0
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
neg eax
mov rcx, r12
sbb ebx, ebx
and ebx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r15, qword [rsp + 0x30]
mov eax, ebx
mov rsi, qword [rsp + 0x60]
add rsp, 0x38
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x140085240
Capabilities:
Write file on windows

Disassembly:
push rsi
push r14
sub rsp, 0x28
mov r14, rcx
mov qword [rsp + 0x48], rbp
mov rcx, qword [rcx + 8]
mov rsi, rdx
test rcx, rcx
je 0x140085261
call fcn.140085240
mov r8, qword [r14 + 0x18]
lea rdx, str._n__s__n_n
mov rcx, rsi
call fcn.140060950
xor ebp, ebp
cmp dword [r14 + 0x28], ebp
jle 0x140085402
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r15
xor r15d, r15d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r14 + 0x20]
mov rcx, rsi
mov rdi, qword [r15 + rax + 8]
mov r8, qword [r15 + rax]
test rdi, rdi
je 0x1400853d7
lea rdx, [0x14010a930]
call fcn.140060950
xor ebx, ebx
lea rax, [rdi + 2]
nop dword [rax + rax]
cmp byte [rax - 2], 0
je 0x14008531e
cmp byte [rax - 1], 0
je 0x14008531b
cmp byte [rax], 0
je 0x140085315
cmp byte [rax + 1], 0
je 0x14008530f
cmp byte [rax + 2], 0
je 0x140085309
cmp byte [rax + 3], 0
je 0x140085303
add rbx, 6
add rax, 6
cmp rbx, 0x3c
jb 0x1400852d0
jmp 0x14008531e
add rbx, 5
jmp 0x14008531e
add rbx, 4
jmp 0x14008531e
add rbx, 3
jmp 0x14008531e
add rbx, 2
jmp 0x14008531e
inc rbx
mov r9, rsi
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea rdx, [0x140106ee0]
mov rcx, rsi
call fcn.140060950
add rdi, rbx
cmp byte [rdi], 0
je 0x1400853e3
nop
xor ebx, ebx
lea rax, [rdi + 2]
cmp byte [rax - 2], 0
je 0x140085398
cmp byte [rax - 1], 0
je 0x140085395
cmp byte [rax], 0
je 0x14008538f
cmp byte [rax + 1], 0
je 0x140085389
cmp byte [rax + 2], 0
je 0x140085383
add rbx, 5
add rax, 5
cmp rbx, 0x50
jb 0x140085356
jmp 0x140085398
add rbx, 4
jmp 0x140085398
add rbx, 3
jmp 0x140085398
add rbx, 2
jmp 0x140085398
inc rbx
mov rdx, rsi
mov ecx, 0x2b
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov r9, rsi
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rdx, rsi
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add rdi, rbx
cmp byte [rdi], 0
jne 0x140085350
jmp 0x1400853e3
lea rdx, [0x14010a934]
call fcn.140060950
inc ebp
add r15, 0x10
cmp ebp, dword [r14 + 0x28]
jl 0x1400852a0
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [r14]
mov rbp, qword [rsp + 0x48]
test rcx, rcx
je 0x140085417
mov rdx, rsi
call fcn.140085240
and byte [r14 + 0x30], 0xfe
xor eax, eax
add rsp, 0x28
pop r14
pop rsi
ret
Function at 0x140090b20
Capabilities:
Accept command line arguments

Disassembly:
mov dword [rsp + 0x10], edx
push rsi
push rdi
push r12
push r15
sub rsp, 0x48
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x78]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [rsp + 0x78]
mov r15, rax
inc ecx
movsxd rcx, ecx
shl rcx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [rsp + 0x78]
xor r12d, r12d
mov qword [rdi], rax
mov esi, r12d
test ecx, ecx
jle 0x140090c5d
mov qword [rsp + 0x70], rbx
mov ebx, r12d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x80], rbp
nop word [rax + rax]
mov r8, qword [rbx + r15]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], r12
xor edx, edx
mov qword [rsp + 0x30], r12
mov ecx, 0xfde9
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r14, eax
test eax, eax
jle 0x140090c25
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [rbx + r15]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], r12
xor edx, edx
mov qword [rsp + 0x30], r12
mov ecx, 0xfde9
mov dword [rsp + 0x28], r14d
mov rbp, rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140090c06
mov rcx, qword [rdi]
mov qword [rbx + rcx], rbp
jmp 0x140090c39
lea rcx, [0x140105588]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, qword [rdi]
mov qword [rbx + rcx], rax
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140090c39
lea rcx, [0x140105588]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, qword [rdi]
mov qword [rbx + rcx], rax
mov ecx, dword [rsp + 0x78]
inc esi
add rbx, 8
cmp esi, ecx
jl 0x140090b90
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov rax, qword [rdi]
movsxd rcx, ecx
mov qword [rax + rcx*8], r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x78]
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rsi
ret

Function at 0x1400912a0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor esi, esi
movsxd r14, r9d
mov rbp, r8
mov r15, rdx
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r12, qword [rsp + 0x60]
mov ebx, 0x41
mov edi, eax
nop dword [rax + rax]
test dil, 1
je 0x14009130b
mov rdx, r14
lea r8, str._c:_
mov r9d, ebx
mov rcx, rbp
call fcn.1400894c0
mov r8, r12
mov rdx, rbp
mov rcx, r15
call fcn.1400c1490
inc esi
inc ebx
shr edi, 1
cmp ebx, 0x5a
jle 0x1400912e0
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140091740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140091754
test ebx, ebx
jle 0x140091775
movsxd rax, ebx
movzx ecx, byte [rax + rdx - 1]
cmp cl, 0x2f
je 0x140091773
cmp cl, 0x5c
jne 0x140091775
dec ebx
cmp ebx, 1
jge 0x140091787
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rdi
cmp ebx, 2
jne 0x1400917cc
movsx ecx, byte [rdx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x1400917cc
cmp byte [rsi + 1], 0x3a
jne 0x1400917cc
movzx eax, byte [rsi]
mov ebx, 3
mov byte [rsp + 0x40], al
lea rsi, [rsp + 0x40]
movzx eax, word [0x14010b93c]
mov word [rsp + 0x41], ax
movzx eax, byte [0x14010b93e]
mov byte [rsp + 0x43], al
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call fcn.1400811f0
mov rcx, qword [0x1401355b8]
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, edi
mov edx, ebx
mov r8, rax
mov qword [0x1401355b8], rax
mov rcx, rsi
call fcn.1400811f0
mov ecx, eax
xor ebx, ebx
mov rax, qword [0x1401355b8]
mov word [rax + rcx*2], bx
mov rcx, qword [0x1401355b8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdi, qword [rsp + 0x30]
cmp eax, 0xffffffff
je 0x140091837
test al, 0x10
je 0x140091837
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x140092090
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400920b0
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call fcn.1400811f0
mov rcx, qword [0x1401355b8]
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, edi
mov edx, ebx
mov r8, rax
mov qword [0x1401355b8], rax
mov rcx, rsi
call fcn.1400811f0
mov ecx, eax
xor edx, edx
mov rax, qword [0x1401355b8]
mov word [rax + rcx*2], dx
mov rcx, qword [0x1401355b8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
Function at 0x140092130
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x140131048]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rax, qword [0x140135638]
mov r15, rdx
mov qword [rbp - 1], rdx
test rax, rax
jne 0x140092186
lea rcx, str.Rpcrt4.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140135638], rax
test rax, rax
je 0x14009222e
lea rdx, str.UuidCreate
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14009222e
lea rcx, [rbp + 7]
call rax
test eax, eax
je 0x1400921b7
cmp eax, 0x720
je 0x1400921b7
cmp eax, 0x6cb
jne 0x14009222e
movzx edx, byte [rbp + 0x15]
mov rcx, r15
movzx r8d, byte [rbp + 0x14]
movzx r9d, byte [rbp + 0x13]
movzx eax, byte [rbp + 0x16]
movzx r10d, byte [rbp + 0x12]
movzx r11d, byte [rbp + 0x11]
movzx ebx, byte [rbp + 0x10]
movzx edi, byte [rbp + 0xf]
movzx esi, word [rbp + 0xd]
movzx r14d, word [rbp + 0xb]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], edx
mov edx, 0x25
mov dword [rsp + 0x58], r8d
lea r8, str._08lX__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
mov dword [rsp + 0x50], r9d
mov r9d, dword [rbp + 7]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
call fcn.1400894c0
jmp 0x14009235e
mov qword [rsp + 0x120], r12
xor ecx, ecx
mov qword [rsp + 0x130], r13
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov qword [rbp - 9], rax
mov qword [rbp - 0x19], rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
lea rdx, [rbp - 0x11]
mov dword [rbp - 0x11], select
lea rcx, [rbp + 0x17]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov r9, qword [rbp - 9]
lea rax, [rbp - 0x19]
shr rax, 8
lea rcx, [rbp - 0x19]
movzx r15d, al
lea rax, [rbp - 0x19]
movzx esi, al
mov eax, r14d
sar eax, 0x18
movzx edi, al
mov eax, r14d
sar eax, 0x10
movzx ebx, al
mov eax, r14d
sar eax, 8
movzx r10d, al
mov rax, r9
sar rax, 0x18
movzx r8d, al
mov rax, r9
sar rax, 0x10
movzx edx, al
mov rax, r9
shr rcx, 0x18
movzx r13d, cl
lea rcx, [rbp - 0x19]
sar rax, 8
shr rcx, 0x10
movzx r12d, cl
movzx ecx, al
movzx eax, byte [rbp + 0x1a]
mov dword [rsp + 0x90], eax
movzx eax, byte [rbp + 0x19]
mov dword [rsp + 0x88], eax
movzx eax, byte [rbp + 0x18]
mov dword [rsp + 0x80], eax
movzx eax, byte [rbp + 0x17]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], r10d
movzx r11d, r14b
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], r8d
lea r8, str._02X_02X_02X_02X__02X_02X__02X_02X__02X_02X__02X_02X_02X_02X_02X_02X
mov dword [rsp + 0x28], edx
mov edx, 0x25
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbp - 1]
movzx r9d, r9b
call fcn.1400894c0
mov r13, qword [rsp + 0x130]
mov r12, qword [rsp + 0x120]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400ea730
mov rbx, qword [rsp + 0x138]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400924e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, r8
mov rdi, rdx
test r8, r8
je 0x14009250a
movsxd rdx, r9d
lea r8, str.open__s
mov r9, rdi
mov rcx, rax
call fcn.1400894c0
xor ebx, ebx
mov dword [rsp + 0x28], 5
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov r8, rdi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp rax, 0x20
seta bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140092580
Capabilities:
Get common file path

Disassembly:
push rbx
push r14
sub rsp, 0x38
mov rax, qword [0x140135640]
mov r14, r9
mov ebx, r8d
test rax, rax
jne 0x1400925ac
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x140135640], rax
mov edx, 0x23
mov qword [rsp + 0x20], rax
mov ecx, 0x1a
test bl, bl
cmovne edx, ecx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x1400925dc
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
mov qword [rsp + 0x50], rbp
mov rbp, qword [0x140135640]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov rdi, 0xffffffffffffffff
mov rsi, rdi
mov qword [rsp + 0x30], r15
inc rsi
cmp word [rbp + rsi*2], 0
jne 0x140092601
mov r9d, esi
mov r8, rbp
xor edx, edx
xor ecx, ecx
call fcn.140081100
xor ecx, ecx
lea ebx, [rax + 1]
mov edx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, esi
mov r8, rbp
mov rcx, rax
mov edx, ebx
mov r15, rax
call fcn.140081100
mov rdx, qword [0x140135640]
mov rsi, qword [rsp + 0x58]
sub rdx, r15
mov rbp, qword [rsp + 0x50]
mov ecx, eax
mov byte [rcx + r15], 0
mov rcx, r15
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140092660
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, qword [rsp + 0x30]
test r14, r14
je 0x140092687
cmp byte [r14], 0
jne 0x14009268e
lea r14, str.unknown
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x14009269d
cmp byte [rdx], 0
jne 0x1400926a4
lea rdx, str.unknown
mov rcx, qword [0x140135640]
mov rax, rdi
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x1400926b0
mov r10d, 0x800
sub r10, rax
inc rdi
cmp byte [rcx + rdi], 0
jne 0x1400926c2
mov qword [rsp + 0x20], rdx
lea r8, str.__s__s.prefs
mov rdx, r10
add rcx, rdi
mov r9, r14
call fcn.1400894c0
mov rax, qword [0x140135640]
mov rdi, qword [rsp + 0x60]
mov rcx, rax
movzx edx, byte [rax]
test dl, dl
je 0x140092713
nop dword [rax + rax]
cmp dl, 0x5c
jne 0x140092708
mov byte [rcx], 0x2f
movzx edx, byte [rcx + 1]
inc rcx
test dl, dl
jne 0x140092700
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x1400927b0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, 0xffffffffffffffff
mov r14, r8
mov rsi, rbx
mov rbp, rdx
nop word [rax + rax]
inc rsi
cmp byte [rsi + rdx], 0
jne 0x1400927e0
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rbp
call fcn.1400811f0
mov rcx, qword [0x1401355b8]
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, edi
mov edx, esi
mov r8, rax
mov qword [0x1401355b8], rax
mov rcx, rbp
call fcn.1400811f0
mov ecx, eax
xor esi, esi
mov rax, qword [0x1401355b8]
mov word [rax + rcx*2], si
inc rbx
cmp byte [r14 + rbx], sil
jne 0x140092834
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, r14
call fcn.1400811f0
mov rcx, qword [0x1401355c0]
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, edi
mov edx, ebx
mov r8, rax
mov qword [0x1401355c0], rax
mov rcx, r14
call fcn.1400811f0
mov ecx, eax
mov rax, qword [0x1401355c0]
mov word [rax + rcx*2], si
mov rdx, qword [0x1401355c0]
mov rcx, qword [0x1401355b8]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]

Function at 0x1400928c0
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400928e0
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call fcn.1400811f0
mov rcx, qword [0x1401355b8]
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, edi
mov edx, ebx
mov r8, rax
mov qword [0x1401355b8], rax
mov rcx, rsi
call fcn.1400811f0
mov ecx, eax
xor edx, edx
mov rax, qword [0x1401355b8]
mov word [rax + rcx*2], dx
mov rcx, qword [0x1401355b8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrmdir]

Function at 0x140092960
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140092980
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call fcn.1400811f0
mov rcx, qword [0x1401355b8]
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, edi
mov edx, ebx
mov r8, rax
mov qword [0x1401355b8], rax
mov rcx, rsi
call fcn.1400811f0
mov ecx, eax
xor edx, edx
mov rax, qword [0x1401355b8]
mov word [rax + rcx*2], dx
mov rcx, qword [0x1401355b8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]