joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003fad0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14005d340
sub rsp, rax
mov rax, qword [0x14007d040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14007fb40]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14003fcdd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14003fc29
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14003fc29
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14003fc09
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14003fb98
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14003fc9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003fcfc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14003fcd8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003fcfc
jmp 0x14003fb6e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140009ca0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14004de30
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140004110
lea rcx, [rsp + 0x40]
call fcn.14004ddf0
movzx eax, al
test eax, eax
jne 0x14004de78
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.14004dd20
mov rax, qword [rsp + 0x70]
jmp 0x14004e049
lea rcx, [rsp + 0x40]
call fcn.140009560
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14004dda0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140009560
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.14004a000
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14004df1e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.14004dd20
mov rax, qword [rsp + 0x80]
jmp 0x14004e049
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14001a480
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004110
lea rcx, [rsp + 0x48]
call fcn.140009c40
movzx eax, al
test eax, eax
jne 0x14004df85
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140009c20
lea rcx, [rsp + 0x40]
call fcn.14004dd20
mov rax, qword [rsp + 0x88]
jmp 0x14004e049
lea rcx, [rsp + 0x48]
call fcn.140009560
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140009560
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.14004a000
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14004e01b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140009c20
lea rcx, [rsp + 0x40]
call fcn.14004dd20
mov rax, qword [rsp + 0xa0]
jmp 0x14004e049
lea rcx, [rsp + 0x48]
call fcn.14000ce10
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140009c20
lea rcx, [rsp + 0x40]
call fcn.14004dd20
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x14005b1e0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.14002f120
lea rcx, [rsp + 0x48]
call fcn.14002f120
call fcn.140038440
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.14002f010
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14005b24f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.14002f1b0
lea rcx, [rsp + 0x78]
call fcn.14002f1b0
mov eax, dword [rsp + 0x24]
jmp 0x14005b2e0
call fcn.140038440
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.14002f010
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14005b296
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.14002f1b0
lea rcx, [rsp + 0x78]
call fcn.14002f1b0
mov eax, dword [rsp + 0x2c]
jmp 0x14005b2e0
lea rcx, [rsp + 0x48]
call fcn.14002f4d0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.14002f4d0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.14002f1b0
lea rcx, [rsp + 0x78]
call fcn.14002f1b0
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x14000fd64
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
and qword [rsp + 0x50], 0
mov rsi, rdx
mov ebp, ecx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8, rax
lea rdx, str._ls__Reinvoke
lea rcx, [rsp + 0x50]
call fcn.14007a60c
mov edi, eax
test eax, eax
js 0x14000fe39
mov rcx, qword [rsp + 0x50]
mov r8, rsi
mov edx, ebp
call fcn.14000fc48
mov edi, eax
test eax, eax
jns 0x14000fe04
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14000fdee
test byte [rcx + 0x1c], 1
je 0x14000fdee
mov r9, qword [rsp + 0x50]
lea r8, [0x1400a7e08]
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov dword [rsp + 0x20], edi
call fcn.140003c68
mov rdx, qword [rsp + 0x50]
lea rcx, str.ERROR:_RunWithRestrictedPriv__s__Failed__lx_n
mov r8d, edi
call fcn.140077d60
jmp 0x14000fe39
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14000fe37
test byte [rcx + 0x1c], 4
je 0x14000fe37
mov r9, qword [rsp + 0x50]
lea r8, [0x1400a7e08]
mov rcx, qword [rcx + 0x10]
mov edx, 0xd
call fcn.140003b90
xor edi, edi
cmp qword [rsp + 0x50], 0
je 0x14000fe4b
mov rcx, qword [rsp + 0x50]
call fcn.140083d40
mov rbp, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140010034
Capabilities:
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1400d7c88]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [rsp + 0x30], 0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov r15, r8
mov r14d, edx
mov dword [rsp + 0x38], 0x104
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
lea edx, [rbx + 0xf]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r13, str.8__r_
test eax, eax
jne 0x1400100e4
call fcn.14007a89c
mov edi, eax
mov rcx, qword [str.8__r_]
cmp rcx, r13
je 0x1400100ce
test byte [rcx + 0x1c], 1
je 0x1400100ce
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x12]
mov r9d, eax
lea r8, [0x1400a7e08]
call fcn.140004000
mov edx, edi
lea rcx, str.ERROR:_OpenProcessToken___Failed__lx_n
call fcn.140077d60
test edi, edi
js 0x14001020e
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
call fcn.140010558
mov edi, eax
test eax, eax
jns 0x14001014a
mov rcx, qword [str.8__r_]
cmp rcx, r13
je 0x140010123
test byte [rcx + 0x1c], 1
je 0x140010123
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400a7e08]
mov edx, 0x13
mov r9d, eax
call fcn.140004000
mov edx, edi
lea rcx, str.ERROR:_RestrictTokenPrivileges___Failed__lx_n
call fcn.140077d60
mov rbx, qword [rsp + 0x40]
xor edi, edi
test rbx, rbx
je 0x14001014f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x14001014f
mov rbx, qword [rsp + 0x40]
lea r8, [rsp + 0x38]
mov ecx, 0x10002
lea rdx, [rsp + 0x50]
call qword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x1400101a7
call fcn.14007a89c
mov edi, eax
mov rcx, qword [str.8__r_]
cmp rcx, r13
je 0x140010199
test byte [rcx + 0x1c], 1
je 0x140010199
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400a7e08]
mov edx, 0x14
mov r9d, eax
call fcn.140004000
mov edx, edi
lea rcx, str.ERROR:_GetUserNameW___Failed__lx_n
call fcn.140077d60
test edi, edi
js 0x14001020e
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x50]
test rbx, rbx
mov qword [rsp + 0x20], r15
mov r9d, r14d
mov rdx, rsi
cmovne rcx, rbx
call fcn.140010250
mov edi, eax
test eax, eax
jns 0x14001020c
mov rcx, qword [str.8__r_]
cmp rcx, r13
je 0x1400101fc
test byte [rcx + 0x1c], 1
je 0x1400101fc
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400a7e08]
mov edx, 0x15
mov r9d, eax
call fcn.140004000
mov edx, edi
lea rcx, str.ERROR:_CreateProcessFromToken___Failed__lx_n
call fcn.140077d60
jmp 0x14001020e
xor edi, edi
test rbx, rbx
je 0x14001021c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001022c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140083d20
add rsp, 0x270
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400114e0
Capabilities:
Create directory

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rcx], 0
lea rbx, [0x1400a1ef4]
and qword [rbp - 0x10], 0
lea rdx, [rbp - 0x10]
and qword [rbp + 0x40], 0
mov rsi, rcx
and qword [rbp + 0x48], 0
mov rcx, rbx
call qword [sym.imp.mpclient.dll_MpConfigOpen]
mov edi, eax
test eax, eax
jns 0x14001156a
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x140011553
test byte [rcx + 0x1c], 1
je 0x140011553
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ad968]
mov edx, 0xb
mov dword [rsp + 0x20], edi
mov r9, rbx
call fcn.140003c68
mov r8d, edi
lea rcx, str.ERROR:_MpConfigOpen__ls__failed___lx__n
mov rdx, rbx
call fcn.140077d60
jmp 0x1400116f0
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140011579
call qword [sym.imp.mpclient.dll_MpFreeMemory]
and dword [rbp + 0x30], 0
mov dword [rbp + 0x38], 2
and qword [rsp + 0x28], 0
lea rax, [rbp + 0x40]
mov rcx, qword [rbp - 0x10]
lea r15, str.ProductAppDataPath
mov rdx, r15
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x38]
call qword [sym.imp.mpclient.dll_MpConfigGetValueAlloc]
mov edi, eax
test eax, eax
jns 0x140011609
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x1400115ef
test byte [rcx + 0x1c], 1
je 0x1400115ef
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ad968]
mov edx, 0xc
mov dword [rsp + 0x28], edi
mov r9, rbx
mov qword [rsp + 0x20], r15
call fcn.140011338
mov r9d, edi
lea rcx, str.ERROR:_MpConfigGetValueString__ls_ls__failed___lx__n
mov r8, r15
mov rdx, rbx
call fcn.140077d60
jmp 0x1400116f0
mov r8, qword [rbp + 0x40]
lea r9, str.Support
lea rdx, str._s_s
lea rcx, [rbp + 0x48]
call fcn.14007a60c
mov edi, eax
test eax, eax
jns 0x14001166f
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x14001165b
test byte [rcx + 0x1c], 1
je 0x14001165b
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ad968]
mov edx, 0xd
mov r9d, edi
call fcn.140004000
mov edx, edi
lea rcx, str.ERROR:_NewSprintfW___failed___lx__n
call fcn.140077d60
mov rbx, qword [rbp + 0x48]
jmp 0x1400116e3
mov rbx, qword [rbp + 0x48]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400116db
call fcn.14007a89c
mov edi, eax
cmp eax, 0x800700b7
je 0x1400116d9
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x1400116c5
test byte [rcx + 0x1c], 1
je 0x1400116c5
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ad968]
mov edx, 0xe
mov dword [rsp + 0x20], edi
mov r9, rbx
call fcn.140003c68
mov r8d, edi
lea rcx, str.ERROR:_CreateDirectoryW__ls__failed___lx__n
mov rdx, rbx
call fcn.140077d60
jmp 0x1400116e3
xor edi, edi
mov rax, rbx
xor ebx, ebx
mov qword [rsi], rax
test rbx, rbx
je 0x1400116f0
mov rcx, rbx
call fcn.140083d40
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x1400116ff
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14001170e
call qword [sym.imp.mpclient.dll_MpConfigClose]
mov eax, edi
add rsp, 0x40
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001171c
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 0x10], 0
mov r12, rdx
mov rdx, rcx
mov rdi, rcx
lea rcx, [rbp - 0x10]
mov r13, r9
call fcn.140082f84
mov ebx, eax
test eax, eax
jns 0x140011786
mov rcx, qword [str.8__r_]
lea rsi, str.8__r_
cmp rcx, rsi
je 0x1400118f6
test byte [rcx + 0x1c], 1
je 0x1400118f6
mov edx, 0x16
mov dword [rsp + 0x20], eax
jmp 0x1400118e3
mov rcx, qword [rbp - 0x10]
and qword [rbp - 0x20], 0
mov rax, qword [rcx]
movabs r10, 0xc56426dd7e555a70
mov rax, qword [rax + 0x18]
lea rdx, [rbp - 0x20]
call qword [0x14009aae8]
lea rsi, str.8__r_
jmp 0x1400118be
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x14001197e
add rdx, 0x2c
xor r9d, r9d
mov r8, r12
mov rcx, rdi
call fcn.140016a64
test eax, eax
jns 0x140011810
mov rcx, qword [str.8__r_]
cmp rcx, rsi
je 0x14001189f
test byte [rcx + 0x1c], 1
je 0x14001189f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ad968]
mov edx, 0x18
mov r9d, eax
call fcn.140004000
jmp 0x14001189f
mov r9, qword [rbp - 0x20]
lea rdx, [0x1400a8260]
and qword [rbp - 0x18], 0
lea rcx, [rbp - 0x18]
add r9, 0x2c
mov r8, r12
call fcn.14000a974
mov ebx, eax
test eax, eax
js 0x140011932
lea rax, [rbp - 0x18]
mov rcx, r13
lea rdx, [rbp - 8]
mov qword [rbp - 8], rax
call fcn.14001bab4
mov ebx, eax
test eax, eax
js 0x140011932
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x14001189f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140011896
mov rcx, qword [str.8__r_]
cmp rcx, rsi
je 0x140011896
test byte [rcx + 0x1c], 1
je 0x140011896
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0xa]
mov r9, rbx
lea r8, [0x1400ad968]
call fcn.140003b90
mov rcx, rbx
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
movabs r10, 0xc56426dd7e555a70
mov rax, qword [rax + 0x18]
lea rdx, [rbp - 0x20]
call qword [0x14009aae8]
mov ebx, eax
test eax, eax
jns 0x1400117b6
mov rcx, qword [str.8__r_]
cmp rcx, rsi
je 0x1400118f6
test byte [rcx + 0x1c], 1
je 0x1400118f6
mov edx, 0x17
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ad968]
mov r9, rdi
call fcn.140003c68
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140011916
mov rdx, qword [rcx]
movabs r10, 0xcc411749525d9370
mov rax, qword [rdx + 8]
call qword [0x14009aae8]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x1400118f6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140011970
mov rcx, qword [str.8__r_]
cmp rcx, rsi
je 0x140011970
test byte [rcx + 0x1c], 1
je 0x140011970
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0xa]
mov r9, rdi
lea r8, [0x1400ad968]
call fcn.140003b90
mov rcx, rdi
call qword [sym.imp.mpclient.dll_MpFreeMemory]
jmp 0x1400118f6
xor ebx, ebx
jmp 0x1400118f6
Function at 0x140016a64
Capabilities:
Copy file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push r13
push r14
push r15
sub rsp, 0x30
and qword [rax - 0x28], 0
mov r14, r9
and qword [rax - 0x20], 0
mov r15, r8
mov rbp, rdx
mov rbx, rcx
mov rcx, qword [str.8__r_]
lea r13, str.8__r_
cmp rcx, r13
je 0x140016ac4
test byte [rcx + 0x1c], 4
je 0x140016ac4
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ad968]
mov edx, 0x91
mov r9, rbp
call fcn.140003b90
mov r9, rbp
lea rdx, [0x1400a8260]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14007a60c
mov esi, eax
test eax, eax
jns 0x140016b23
mov rcx, qword [str.8__r_]
cmp rcx, r13
je 0x140016b0b
test byte [rcx + 0x1c], 1
je 0x140016b0b
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ad968]
mov edx, 0x92
mov r9d, eax
call fcn.140004000
mov edx, esi
lea rcx, str.ERROR:_NewSprintfW___failed___lx__n
call fcn.140077d60
mov rbx, qword [rsp + 0x20]
jmp 0x140016c63
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
mov rdx, rbx
call fcn.14007a414
mov esi, eax
test eax, eax
jns 0x140016b78
mov rcx, qword [str.8__r_]
cmp rcx, r13
je 0x140016b65
test byte [rcx + 0x1c], 1
je 0x140016b65
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ad968]
mov edx, 0x93
mov r9d, eax
call fcn.140004000
lea rcx, str.ERROR:_UtilExpandEnvironmentStrings___failed___lx__n
mov edx, esi
call fcn.140077d60
jmp 0x140016c51
test r14, r14
cmovne rbp, r14
test rbx, rbx
je 0x140016b92
mov rcx, rbx
call fcn.140083d40
and qword [rsp + 0x20], 0
mov r9, rbp
lea rdx, [0x1400a8260]
mov r8, r15
lea rcx, [rsp + 0x20]
call fcn.14007a60c
mov esi, eax
test eax, eax
jns 0x140016bee
mov rcx, qword [str.8__r_]
cmp rcx, r13
je 0x140016bd9
test byte [rcx + 0x1c], 1
je 0x140016bd9
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ad968]
mov edx, 0x94
mov r9d, eax
call fcn.140004000
mov edx, esi
lea rcx, str.ERROR:_NewSprintfW___failed___lx__n
call fcn.140077d60
mov rbx, qword [rsp + 0x20]
jmp 0x140016c51
mov rbx, qword [rsp + 0x20]
xor r8d, r8d
mov rcx, qword [rsp + 0x28]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140016c4f
call fcn.14007a89c
mov esi, eax
add eax, 0x7ff8fffe
cmp eax, 1
jbe 0x140016c4f
mov rcx, qword [str.8__r_]
cmp rcx, r13
je 0x140016c43
test byte [rcx + 0x1c], 1
je 0x140016c43
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ad968]
mov edx, 0x95
mov r9d, esi
call fcn.140004000
lea rcx, str.ERROR:_CopyFileW___failed___lx__n
jmp 0x140016b6c
xor esi, esi
cmp qword [rsp + 0x28], 0
je 0x140016c63
mov rcx, qword [rsp + 0x28]
call fcn.140083d40
test rbx, rbx
je 0x140016c70
mov rcx, rbx
call fcn.140083d40
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x140018b70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1400d7c88]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140018bb4
movzx eax, r14w
jmp 0x140018d00
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140018bf0
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140018bf0
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x140018d00
cmp qword [rcx + 0x80], r14
je 0x140018cfd
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140018c2e
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140018c58
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, di
je 0x140018cfd
movzx edi, si
jmp 0x140018cfd
mov word [rbp + 7], si
lea rdx, [rbx + 0x74]
mov qword [rbp + 0x17], r14
mov qword [rbp + 0xf], r14
mov rax, qword [rcx]
movabs r10, 0x8e0d0e2510d1fa70
mov rax, qword [rax + 0x38]
lea r8, [rbp + 0xf]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x14009aae8]
test eax, eax
je 0x140018cc2
sub eax, 1
je 0x140018cc2
cmp eax, 2
jne 0x140018cfd
movzx ecx, word [rbp + 7]
jmp 0x140018c3a
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x140018ced
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x140018cfd
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
cmovne di, si
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140083d20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400198a0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rdi, rcx
cmp rbx, rcx
je 0x140019912
mov rsi, qword [rbx + 0x10]
test rsi, rsi
je 0x14001990a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140019901
mov rcx, qword [str.8__r_]
lea rax, str.8__r_
cmp rcx, rax
je 0x140019901
test byte [rcx + 0x1c], 1
je 0x140019901
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ad968]
mov edx, 0xa
mov r9, rsi
call fcn.140003b90
mov rcx, rsi
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400198ba
mov rbx, qword [rdi]
mov esi, 0x18
jmp 0x14001993c
mov rdx, qword [rbx]
mov rcx, rbx
mov rbx, rdx
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rdx, rsi
call fcn.140084038
dec qword [rdi + 0x10]
cmp rbx, rdi
jne 0x14001991c
cmp qword [rdi + 0x10], 0
je 0x140019972
mov rbx, qword [rdi]
jmp 0x14001996d
mov rdx, qword [rbx]
mov rcx, rbx
mov rbx, rdx
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rdx, rsi
call fcn.140084038
dec qword [rdi + 0x10]
cmp rbx, rdi
jne 0x14001994d
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14001a930
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400d7c88]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001a9cb
cmp byte [rcx + 0x72], 0
je 0x14001a9cb
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
movabs r10, 0x943d279d16d15a70
mov rax, qword [rax + 0x18]
call qword [0x14009aae8]
cmp di, ax
je 0x14001aa20
mov rcx, qword [rbx + 0x68]
lea rdx, [rbx + 0x74]
and qword [rsp + 0x30], 0
mov rax, qword [rcx]
movabs r10, 0xd275361c54538b70
mov rax, qword [rax + 0x40]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [0x14009aae8]
test eax, eax
je 0x14001a9e5
sub eax, 1
je 0x14001a9e9
cmp eax, 2
jne 0x14001aa20
mov byte [rbx + 0x72], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140083d20
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001aa17
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001aa20
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14001a9cd
xor al, al
jmp 0x14001a9cd