joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b4230
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push r12
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
movzx r12d, dl
mov rbx, rcx
jne 0x1400b425a
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x140112488]
mov rcx, rbx
mov rdx, rax
mov rdi, rax
call fcn.1400b47d0
cmp byte [rbx], 0
mov rbp, rax
je 0x1400b4291
test rax, rax
jne 0x1400b429a
jmp 0x1400b4332
test rax, rax
jne 0x1400b432d
test rdi, rdi
je 0x1400b432d
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
mov qword [rsp + 0x38], rsi
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001a70
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b430f
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rsi + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x1400b430f
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001a70
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400b42e0
mov rax, qword [0x140112488]
mov rsi, qword [rsp + 0x38]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x1400b432d
mov edx, 1
call fcn.140001a70
cmp byte [rbx], 0
je 0x1400b4346
xor r9d, r9d
mov r8, rbp
movzx edx, r12b
mov rcx, rbx
call fcn.1400b4370
jmp 0x1400b4352
movzx edx, r12b
mov rcx, rbx
call fcn.1400b4540
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400b4540
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x11ce0
call fcn.1400d1910
sub rsp, rax
cmp qword [rcx + 0x10], 0
movzx edi, dl
mov rbx, rcx
je 0x1400b4705
xor edx, edx
call fcn.1400b4720
test eax, eax
jne 0x1400b4580
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11ce0
pop rdi
ret
mov qword [rsp + 0x11cf0], rbp
mov qword [rsp + 0x11cf8], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x140112488]
mov rcx, rbx
mov rdx, rax
mov rsi, rax
call fcn.1400b47d0
mov ecx, dword [0x14011910c]
xor ebp, ebp
test rax, rax
lea rax, [0x1400e245c]
cmovne ecx, ebp
mov qword [rsp + 0x1048], rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x1884], ebp
mov qword [rsp + 0x1888], rbp
mov qword [rsp + 0x1890], rbp
mov dword [0x14011910c], ecx
mov qword [rsp + 0x18b8], rbp
mov qword [rsp + 0x18c0], rbp
test dil, dil
je 0x1400b460a
mov byte [rsp + 0x1881], bpl
test ecx, ecx
je 0x1400b4612
mov byte [rsp + 0x1881], 1
mov rax, qword [0x140119118]
mov dword [rsp + 0x18a0], ecx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x1898], rax
mov rax, qword [rbx + 0x10]
lea rcx, [0x1400b48f0]
mov qword [rsp + 0x18a8], rax
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x1888]
test rax, rax
je 0x1400b46c9
lea rdx, [rsp + 0x20]
lea rcx, [0x1400b2f20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbp
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x1400b4690
mov rcx, qword [rsp + 0x1888]
call fcn.1400b3e30
mov qword [rsp + 0x1888], rbx
jmp 0x1400b4698
mov rbx, qword [rsp + 0x1888]
mov rcx, rbx
call fcn.1400b13c0
mov rcx, qword [rsp + 0x1888]
call fcn.1400b3e30
mov r11, qword [0x140112488]
mov ecx, dword [r11 + 0x74]
cmp ecx, 0xffffffff
jle 0x1400b46f5
mov edx, 1
call fcn.140001a70
jmp 0x1400b46f5
mov eax, dword [0x14011910c]
test eax, eax
je 0x1400b46f5
cmp eax, 1
mov dword [0x14011910c], ebp
setg al
test al, al
je 0x1400b46f5
mov rcx, rsi
call fcn.1400b3e30
xor edx, edx
mov rcx, rbx
call fcn.1400b4540
mov rsi, qword [rsp + 0x11cf8]
mov rbp, qword [rsp + 0x11cf0]
mov eax, 1
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11ce0
pop rdi
ret
Function at 0x1cbee20
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1cbee2d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1cbee3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1cbee25
lea eax, [rcx + 1]
jmp 0x1cbee4b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1cbee5e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1cbee44
sub eax, 3
jb 0x1cbee7e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1cbeecd
sar eax, 1
movsxd rbp, eax
jb 0x1cbeeb4
jmp 0x1cbee8c
add ebx, ebx
jne 0x1cbee8a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1cbeeb4
inc ecx
add ebx, ebx
jne 0x1cbee9a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1cbeeb4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1cbeead
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1cbee9c
add ecx, 2
jmp 0x1cbeeb9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.01cbede2
jmp 0x1cbee2d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x18a8000]
mov eax, dword [rdi]
or eax, eax
je 0x1cbef29
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x18be000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1cbeed9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1cbef23
mov qword [rbx], rax
add rbx, 8
jmp 0x1cbeef9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1cbef6d
cmp al, 0xef
ja 0x1cbef55
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1cbef35
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1cbef44
mov eax, dword [rdi]
add rdi, 4
jmp 0x1cbef44
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1cbefc1
sub rsp, 0xffffffffffffff80
jmp 0x471ca0
Function at 0x140001610
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rsi, r8
xorps xmm0, xmm0
lea rax, [rsp + 0x70]
movaps xmmword [rax], xmm0
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x10], xmm0
xor edi, edi
mov qword [rax + 0x60], rdi
mov dword [rax], 0x68
lea r8, [rsp + 0x50]
mov qword [r8 + 0x10], rdi
movaps xmmword [r8], xmm0
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400016af
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400016c0
xor edi, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
add rsp, 0xd8
pop rdi
pop rsi
ret
mov dil, 1
jmp 0x1400016a4
test rsi, rsi
je 0x1400016bb
mov rcx, qword [rsp + 0x50]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne dil
jmp 0x1400016a4

Function at 0x140001920
Capabilities:
Delete file

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x260
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
xor ebp, ebp
lea rcx, [rsp + 0x56]
mov word [rcx + 0x208], bp
mov word [rcx], bp
mov edx, 0x104
mov r8, r14
call fcn.140003430
test al, al
je 0x1400019e2
lea r8, str.setup.exe
lea rcx, [rsp + 0x56]
mov edx, 0x104
call fcn.140003470
test al, al
je 0x1400019e0
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x2b0]
lea r9, [rsp + 0x28]
mov qword [r9], r14
mov qword [r9 + 8], rbx
mov qword [r9 + 0x10], rsi
mov qword [r9 + 0x18], rcx
mov qword [r9 + 0x20], rax
lea rdx, [0x1400728d4]
lea r8, [0x1400016e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
test eax, eax
je 0x1400019e0
mov edx, 0x104
mov rcx, rbx
call fcn.140003400
test rax, rax
je 0x1400019e0
mov edx, 0x104
mov rcx, rsi
call fcn.140003400
test rax, rax
je 0x140001a01
xor ebp, ebp
mov eax, ebp
add rsp, 0x260
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x715
jne 0x1400019e0
jmp 0x140001a21
lea rdx, [0x1400728da]
lea r8, [0x1400016e0]
lea r9, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
test eax, eax
je 0x1400019f2
mov edx, 0x104
mov rcx, rsi
call fcn.140003400
test rax, rax
je 0x140001a7c
lea rdx, [rsp + 0x56]
mov rcx, rsi
call fcn.1400029f0
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test bl, bl
je 0x1400019e0
lea r8, [rsp + 0x56]
mov edx, 0x104
mov rcx, rsi
call fcn.140003430
mov bpl, 1
test al, al
jne 0x1400019e2
lea rcx, [rsp + 0x56]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400019e0
mov edx, 0x104
mov rcx, rsi
call fcn.140003400
test rax, rax
setne bpl
jmp 0x1400019e2
Function at 0x140001aa0
Capabilities:
Delete directory
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rcx
mov rbx, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rdx
call rbx
mov rcx, rsi
call rbx
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]

Function at 0x140001bb0
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
mov rsi, rdx
mov qword [rdx], 0
xor eax, eax
lea rdx, [rsp + 0x4e]
mov word [rdx + 0x208], ax
mov word [rdx], ax
mov dword [rsp + 0x40], 0
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x140001caf
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x4e]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140001caf
test byte [rsp + 0x40], 8
mov dil, 1
je 0x140001cb2
lea rcx, [rsp + 0x40]
mov qword [rcx], 0
call fcn.140001ad0
xor edi, edi
test al, al
je 0x140001cb2
lea rcx, [rsp + 0x4e]
mov word [rcx + 0x258], di
mov word [rcx], di
lea r8, [0x1400728e0]
mov edx, 0x12c
call fcn.140003470
test al, al
je 0x140001ca2
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x4e]
mov edx, 0x12c
call fcn.140003470
test al, al
je 0x140001ca0
lea r8, [0x14007299a]
lea rcx, [rsp + 0x4e]
mov edx, 0x12c
call fcn.140003470
test al, al
jne 0x140001cbe
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001cb2
mov dil, 1
mov eax, edi
add rsp, 0x2a8
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x4e]
mov edx, 1
mov r8, rsi
xor r9d, r9d
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
setne dil
jmp 0x140001ca2
Function at 0x140001ce0
Capabilities:
Create directory

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rdx
mov r14, rcx
mov edx, 0x104
mov rcx, rsi
mov r8, r14
call fcn.140003430
test al, al
je 0x140001d74
lea r8, [0x14007299e]
mov edi, 0x104
mov edx, 0x104
mov rcx, rsi
call fcn.140003470
test al, al
je 0x140001d74
mov edx, 0x104
mov rcx, rsi
call fcn.140003400
sub rdi, rax
cmp rdi, 0xb
jb 0x140001d74
mov rbx, rax
lea r15, [rsp + 0x30]
mov qword [r15], 0
mov dword [r15 + 8], 0
mov byte [r15 + 0x10], 0
mov dword [r15 - 8], 0x18
mov rcx, r14
mov rdx, r15
call fcn.140001bb0
mov byte [r15 + 0x10], al
test al, al
jne 0x140001da4
xor esi, esi
mov eax, esi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor esi, esi
cmp byte [rsp + 0x40], 0
je 0x140001d76
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001d76
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001d76
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
shr ecx, 0xc
xor ecx, eax
lea r14, [rsp + 0x24]
mov dword [r14], ecx
lea r15, [rsi + rbx*2]
mov r13, rbx
add r13, 5
mov ebp, 0xfffffff6
mov r12, qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x140001e14
mov word [rsi + rbx*2 + 0xa], 0
mov edx, 0x104
mov rcx, rsi
lea r8, str..tmp
call fcn.140003470
mov rdx, qword [rsp + 0x30]
test rdx, rdx
lea rax, [rsp + 0x28]
cmovne rdx, rax
mov rcx, rsi
call r12
test eax, eax
jne 0x140001e3a
inc dword [rsp + 0x24]
inc ebp
je 0x140001d89
mov edx, 4
mov rcx, r14
mov r8, r15
mov r9, rdi
call fcn.1400033a0
test al, al
je 0x140001d89
cmp r13, 0x103
ja 0x140001dd9
jmp 0x140001dd2
lea r8, [0x1400729b0]
mov edx, 0x104
mov rcx, rsi
call fcn.140003470
mov esi, eax
jmp 0x140001d8b

Function at 0x140001e60
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rdx
mov rdi, rcx
xor eax, eax
lea rdx, [rsp + 0x2e]
mov word [rdx + 0x208], ax
mov word [rdx], ax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x140001ea9
lea rcx, [rsp + 0x2e]
mov rdx, rsi
call fcn.140001ce0
mov ecx, eax
mov al, 1
test cl, cl
jne 0x140001eef
lea rdx, [rsp + 0x2e]
mov rcx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140001eed
mov edx, eax
lea rcx, [rsp + 0x2e]
call fcn.140003530
test rax, rax
je 0x140001eed
mov word [rax], 0
lea rcx, [rsp + 0x2e]
mov rdx, rsi
call fcn.140001ce0
jmp 0x140001eef
xor eax, eax
add rsp, 0x238
pop rdi
pop rsi
ret
Function at 0x140001f00
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov rsi, rcx
mov edx, 0x104
call fcn.140003400
mov rdi, rax
lea r8, [0x1400729b4]
mov edx, 0x104
mov rcx, rsi
call fcn.140003470
test al, al
je 0x140001fa5
lea rbx, [rsp + 0x28]
mov r8d, 0x250
mov rcx, rbx
xor edx, edx
call fcn.140002290
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140001f8d
mov rbx, rax
lea r15, [rsp + 0x25c]
lea r12, [rsp + 0x54]
lea r13, [rdi + 1]
lea r14, [rsp + 0x28]
mov rbp, qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x140001fce
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp rdi, 0x103
ja 0x140001f9c
mov word [rsi + rdi*2], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
call fcn.140001f00
mov rcx, rbx
mov rdx, r14
call rbp
test eax, eax
je 0x140001f84
movzx eax, word [rsp + 0x25c]
mov ecx, 0x2c
mov r8, r12
test ax, ax
je 0x140001feb
mov ecx, 0x234
mov r8, r15
test r8, r8
je 0x14000202e
cmp word [rsp + rcx + 0x28], 0x2e
jne 0x14000202e
lea rcx, [rsp + 0x56]
test ax, ax
je 0x14000200a
lea rcx, [rsp + 0x25e]
movzx ecx, word [rcx]
test ecx, ecx
je 0x140001fc2
cmp ecx, 0x2e
jne 0x14000202e
lea rcx, [rsp + 0x58]
test ax, ax
je 0x140002028
lea rcx, [rsp + 0x260]
cmp word [rcx], 0
je 0x140001fc2
cmp r13, 0x103
ja 0x14000203e
mov word [rsi + rdi*2 + 2], 0
mov edx, 0x104
mov rcx, rsi
call fcn.140003470
test al, al
je 0x140001fc2
test byte [rsp + 0x28], 0x10
jne 0x140001fba
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140001fc2
Function at 0x140002070
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x698
mov rdi, rdx
mov rsi, rcx
xor eax, eax
lea rcx, [rsp + 0x284]
mov word [rcx + 0x208], ax
mov word [rcx], ax
mov edx, 0x104
mov r8, rsi
call fcn.140003430
test al, al
je 0x1400020e4
lea rcx, [rsp + 0x284]
mov edx, 0x104
mov r8, rdi
call fcn.140003470
test al, al
je 0x1400020e4
lea r8, [0x1400729be]
lea rcx, [rsp + 0x284]
mov edx, 0x104
call fcn.140003470
test al, al
jne 0x1400020f8
add rsp, 0x698
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, [rsp + 0x34]
mov r8d, 0x250
mov rcx, rdi
xor edx, edx
call fcn.140002290
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x284]
xor edx, edx
mov r8, rdi
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
cmp rax, 0xffffffffffffffff
je 0x1400020e4
mov rdi, rax
xor eax, eax
lea rbx, [rsp + 0x48e]
mov word [rbx + 0x208], ax
mov word [rbx], ax
lea r12, [rsp + 0x268]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x34]
mov rbp, qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x1400021c7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1400020e4
lea rcx, [rsp + 0x26c]
cmp word [rcx], 0
je 0x1400021bb
mov edx, 0x104
mov rcx, rbx
mov r8, rsi
call fcn.140003430
test al, al
je 0x1400021bb
mov edx, 0x104
mov rcx, rbx
mov r8, r15
call fcn.140003470
test al, al
je 0x1400021bb
mov rcx, rbx
call fcn.140001f00
mov rcx, rdi
mov rdx, r14
call rbp
test eax, eax
je 0x14000216f
test byte [rsp + 0x34], 0x10
je 0x1400021bb
movzx eax, word [rsp + 0x268]
mov ecx, 0x2c
mov r15, r13
test ax, ax
je 0x1400021eb
mov ecx, 0x234
mov r15, r12
test r15, r15
je 0x14000218b
cmp word [rsp + rcx + 0x34], 0x2e
jne 0x14000218b
lea rcx, [rsp + 0x62]
test ax, ax
je 0x14000220a
lea rcx, [rsp + 0x26a]
movzx ecx, word [rcx]
test ecx, ecx
je 0x1400021bb
cmp ecx, 0x2e
jne 0x14000218b
lea rcx, [rsp + 0x64]
test ax, ax
je 0x140002185
jmp 0x14000217d

Function at 0x140002230
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x230
xor eax, eax
lea rdx, [rsp + 0x26]
mov word [rdx + 0x208], ax
mov word [rdx], ax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x140002280
lea rdx, [0x14007299e]
lea rsi, [rsp + 0x26]
mov rcx, rsi
call fcn.140002070
lea rdx, str.chrome_
mov rcx, rsi
call fcn.140002070
nop
add rsp, 0x230
pop rsi
ret
Function at 0x1400026d0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x488
mov r8, rcx
xor eax, eax
lea rdi, [rsp + 0x27e]
mov word [rdi + 0x208], ax
mov word [rdi], ax
mov edx, 0x104
mov rcx, rdi
call fcn.140003430
mov edx, 0x104
mov rcx, rdi
call fcn.140003400
mov rsi, rax
lea r8, [0x140072a78]
mov edx, 0x104
mov rcx, rdi
call fcn.140003470
lea rbx, [rsp + 0x2c]
mov r8d, 0x250
mov rcx, rbx
xor edx, edx
call fcn.140002290
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400027dc
mov rdi, rax
lea r15, [rsp + 0x260]
lea r12, [rsp + 0x58]
lea rbx, [rsp + 0x27e]
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r14, [rsp + 0x2c]
mov rbp, qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x140002795
mov rcx, rbx
call r13
mov rcx, rdi
mov rdx, r14
call rbp
test eax, eax
je 0x1400027d3
cmp word [rsp + 0x260], 0
mov r8, r12
je 0x1400027a6
mov r8, r15
cmp rsi, 0x103
ja 0x1400027b9
mov word [rsp + rsi*2 + 0x27e], 0
mov edx, 0x104
mov rcx, rbx
call fcn.140003470
test al, al
je 0x140002789
test byte [rsp + 0x2c], 0x10
jne 0x140002789
jmp 0x140002783
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
add rsp, 0x488
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140002800
Capabilities:
Delete directory
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rdi, r9
mov rbx, r8
mov rsi, rcx
cmp word [rdx], 0
je 0x140002822
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp word [rbx], 0
je 0x140002831
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp word [rdi], 0
je 0x140002840
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp word [rsi], 0
je 0x14000289e
xor eax, eax
lea rcx, [rsp + 0x26]
mov word [rcx + 0x208], ax
mov word [rcx], ax
mov edx, 0x104
mov r8, rsi
call fcn.140003430
test al, al
je 0x14000289e
lea r8, [0x1400729e0]
lea rcx, [rsp + 0x26]
mov edx, 0x104
call fcn.140003470
test al, al
je 0x14000289e
lea rcx, [rsp + 0x26]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rsi
call fcn.1400026d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
add rsp, 0x230
pop rbx
pop rdi
pop rsi
ret
Function at 0x140002c50
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x230
mov rcx, qword [0x140092550]
test rcx, rcx
je 0x140002cd3
lea rdx, str.FDICreate
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rsi
mov qword [0x140092538], rax
mov rcx, qword [0x140092550]
lea rdx, str.FDIDestroy
call rsi
mov qword [0x140092548], rax
mov rcx, qword [0x140092550]
lea rdx, str.FDICopy
call rsi
mov qword [0x140092540], rax
xor eax, eax
cmp qword [0x140092538], 0
je 0x140002cca
cmp qword [0x140092548], 0
je 0x140002cca
cmp qword [0x140092540], 0
setne al
add rsp, 0x230
pop rsi
ret
lea rsi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call fcn.140002290
lea rcx, str._WINDIR__system32cabinet.dll
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x140002d10
mov rcx, qword [0x140092550]
jmp 0x140002d2d
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x140092550], rax
test rcx, rcx
jne 0x140002c64
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str._SYSTEMROOT__system32cabinet.dll
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x140002d65
mov rcx, qword [0x140092550]
jmp 0x140002d82
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x140092550], rax
test rcx, rcx
jne 0x140002c64
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.C:Windows_system32cabinet.dll
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x140002dba
mov rcx, qword [0x140092550]
jmp 0x140002dd7
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x140092550], rax
test rcx, rcx
jne 0x140002c64
jmp 0x140002ca9