joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140067c10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140067c49
mov ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_SetLastError]
shr ebx, 4
and bl, 1
movzx eax, bl
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rsi
mov rcx, rdi
mov esi, 0x5c
mov edx, esi
call fcn.1400cba50
mov rbx, rax
cmp rax, rdi
jbe 0x140067c80
cmp word [rax - 2], 0x3a
je 0x140067c80
xor eax, eax
mov rcx, rdi
mov word [rbx], ax
call fcn.140067c10
mov word [rbx], si
test al, al
je 0x140067c9c
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140067cae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140067cae
mov rsi, qword [rsp + 0x30]
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x30]
mov al, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140069170
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, r8
mov r14, rdx
mov r15, rcx
test r8, r8
je 0x1400691d9
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.1400016b0
cmp byte [rdi + 0x23], 0
mov rsi, rax
jne 0x1400691ac
mov rbx, qword [rdi + 0x10]
jmp 0x1400691af
mov rbx, rdi
cmp byte [rbx + 0x23], 1
jne 0x1400691cd
test byte [rbx + 0x21], 8
je 0x1400691c3
mov rcx, rbx
call fcn.140001550
mov rbp, qword [rbx + 0x10]
add rbx, 0x10
jmp 0x140069223
lea rbx, [0x140137fd0]
mov rbp, qword [rbx]
jmp 0x140069223
lea r8, [rsp + 0x88]
xor ecx, ecx
lea rdx, [rsp + 0x80]
call fcn.1400b0000
test eax, eax
jne 0x140069213
mov rax, qword [0x14012fc08]
xor ebx, ebx
mov dword [rax + 0x40], ebx
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0x40000000
mov rcx, r14
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400692a4
mov dword [rsp + 0x80], ebx
mov ecx, ebx
test rsi, rsi
je 0x140069284
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rbx
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x80]
cmp ecx, ebp
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14012fc08]
mov dword [rcx + 0x40], eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400692b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14012fc08]
mov dword [rcx + 0x40], eax
test rdi, rdi
jne 0x1400692c1
mov rcx, rsi
call fcn.1400d29a8
test ebx, ebx
je 0x1400692f5
mov rcx, qword [0x140134210]
lea rdx, [0x1400fb96c]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [0x14012fc08]
lea rdx, [0x14011037c]
test byte [rax + 0x140], 1
jne 0x140069335
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea r9, [0x1400fb87c]
xor r8d, r8d
mov rcx, r15
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp fcn.140050b90
Function at 0x140069370
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
movzx r8d, word [rdx]
mov rbx, rdx
mov rdi, rcx
mov r9, rdx
test r8w, r8w
je 0x140069476
test rdx, rdx
je 0x1400693d6
mov edx, 0x3f
nop dword [rax + rax]
lea rcx, [0x140119778]
movzx eax, dx
nop word [rax + rax]
cmp r8w, ax
je 0x140069476
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400693b0
movzx r8d, word [r9 + 2]
add r9, 2
test r8w, r8w
jne 0x1400693a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14012fc08]
mov dword [rcx + 0x40], eax
test ebx, ebx
je 0x140069427
mov rcx, qword [0x140134210]
lea rdx, [0x1400fb96c]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
test byte [rcx + 0x140], 1
lea rdx, [0x14011037c]
jne 0x14006945a
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea r9, [0x1400fb87c]
xor r8d, r8d
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140050b90
xor r9d, r9d
mov qword [rsp + 0x28], 0
lea rax, [0x140069360]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call fcn.140069c20
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140069590
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x10040
call fcn.1400eb380
sub rsp, rax
movzx eax, r9b
mov rcx, r8
inc eax
mov qword [rsp + 0x30], 0
mov rbx, rdx
mov dword [rsp + 0x28], 0
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400695f1
xor al, al
mov rbx, qword [rsp + 0x10060]
add rsp, 0x10040
pop rdi
ret
mov qword [rsp + 0x10050], rbp
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x10058], rsi
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140069610
cmp r8, 0x8000
lea rcx, [rsp + 0x40]
mov eax, 0x7fff
mov rdx, rbx
cmovae r8, rax
lea r8, [r8*2 + 2]
call fcn.1400cfd20
lea rcx, [rsp + 0x40]
call fcn.1400dd4e8
mov r8d, 0xa
lea rdx, [rsp + 0x40]
xor ecx, ecx
xor sil, sil
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x1400696ba
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400696ba
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400696ba
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r9, [rsp + 0x10068]
mov qword [rsp + 0x20], 0
mov r8d, eax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne sil
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x10050]
movzx eax, sil
mov rsi, qword [rsp + 0x10058]
mov rbx, qword [rsp + 0x10060]
add rsp, 0x10040
pop rdi
ret
Function at 0x1400696f0
Capabilities:
Copy file
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10020
call fcn.1400eb380
sub rsp, rax
movzx ebx, r9b
mov rcx, r8
mov rdi, rdx
lea r8, [rsp + 0x20]
xor r9d, r9d
mov edx, 0x8000
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rcx, qword [0x1401371c8]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r8d, ebx
lea rdx, [rsp + 0x20]
xor r8d, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea rcx, [0x1400fb87c]
mov rax, qword [0x1401320f0]
setne bl
test rax, rax
je 0x140069764
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
movzx eax, bl
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret

Function at 0x140069860
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rbx, rdx
mov rdi, rcx
mov rcx, qword [0x140136490]
xor edx, edx
lea r8, [r9 - 1]
call fcn.1400b0830
test rbx, rbx
je 0x1400699c5
cmp word [rbx], 0
je 0x1400699c5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400698cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14012fc08]
test byte [rcx + 0x140], 1
mov dword [rcx + 0x40], eax
jmp 0x1400699da
mov rax, qword [0x14012fc08]
lea rdx, [0x1400fb96c]
mov rcx, qword [0x140134210]
xor edi, edi
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov dword [rax + 0x40], edi
lea r8, [rdi - 1]
call fcn.1400b0830
mov ecx, ebx
and ecx, 1
je 0x140069908
mov eax, 0x52
mov word [rsp + 0x30], ax
test bl, 0x20
je 0x140069919
mov edx, 0x41
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
test bl, 4
je 0x14006992a
mov edx, 0x53
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
test bl, 2
je 0x14006993b
mov edx, 0x48
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
test bl, bl
jns 0x14006994b
mov edx, 0x4e
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
test bl, 0x10
je 0x14006995c
mov edx, 0x44
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
bt ebx, 0xc
jae 0x14006996e
mov edx, 0x4f
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
bt ebx, 0xb
jae 0x140069980
mov edx, 0x43
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
bt ebx, 8
jae 0x140069992
mov edx, 0x54
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
xor r9d, r9d
mov word [rsp + rcx*2 + 0x30], di
mov rcx, qword [0x140136490]
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
mov rax, qword [0x14012fc08]
test byte [rax + 0x140], 1
mov dword [rax + 0x40], 0x57
lea rdx, [0x14011037c]
jne 0x140069a0c
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
lea r9, [0x1400fb87c]
xor r8d, r8d
mov rcx, rdi
call fcn.140050b90
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
Function at 0x140069a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
xor esi, esi
xor edx, edx
mov r10d, 0xffffffff
mov ebp, r9d
mov dword [rsp + 0x68], r10d
mov r14, r8
mov dword [rsp + 0x6c], edx
movzx eax, word [rdi]
mov r15, rcx
test ax, ax
je 0x140069b4c
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], r12
lea r12, [0x140000000]
nop dword [rax + rax]
movzx ebx, ax
test ebx, 0xffffff80
je 0x140069a8f
xor eax, eax
jmp 0x140069aa4
mov edx, 2
mov ecx, ebx
call fcn.1400d7464
mov edx, dword [rsp + 0x6c]
mov r10d, dword [rsp + 0x68]
mov ecx, ebx
and ecx, 0xffffffdf
test eax, eax
cmove ecx, ebx
add ecx, 0xffffffd5
cmp ecx, 0x33
ja case.0x140069acd.51
movsxd rax, ecx
movzx eax, byte [r12 + rax + 0x69bac]
mov ecx, dword [r12 + rax*4 + 0x69b88]
add rcx, r12
jmp rcx
movzx esi, word [rdi]
jmp case.0x140069acd.51
mov ecx, 1
jmp 0x140069b03
mov ecx, SafeArrayAllocDescriptor
jmp 0x140069b03
mov ecx, 4
jmp 0x140069b03
mov ecx, 2
jmp 0x140069b03
mov ecx, 0x80
jmp 0x140069b03
mov ecx, 0x1000
jmp 0x140069b03
mov ecx, 0x100
cmp esi, 0x2b
je 0x140069b1f
cmp esi, 0x2d
je 0x140069b16
cmp esi, 0x5e
jne case.0x140069acd.51
xor edx, ecx
jmp 0x140069b2d
not ecx
and r10d, ecx
and edx, ecx
jmp 0x140069b28
mov eax, ecx
not eax
and r10d, eax
or edx, ecx
mov dword [rsp + 0x68], r10d
mov dword [rsp + 0x6c], edx
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x140069a80
mov r12, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
movzx r9d, byte [rsp + 0x80]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov r8d, ebp
lea rax, [0x140069be0]
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.140069c20
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006a630
Capabilities:
Get file size

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x290
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r14, r8
mov rdi, rdx
mov rbp, rcx
xor edx, edx
mov rcx, qword [0x140136490]
lea r8, [r9 - 1]
call fcn.1400b0830
test rdi, rdi
je 0x14006a836
cmp word [rdi], 0
je 0x14006a836
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x2c0], rsi
mov edx, 0x80
mov dword [rsp + 0x28], 0
mov rcx, rdi
mov qword [rsp + 0x2b0], rbx
lea r8d, [r9 + 7]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14006a6e6
lea rdx, [rsp + 0x2b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x14006a6e6
mov rcx, qword [rsp + 0x2b8]
jmp 0x14006a782
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x14006a762
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14012fc08]
lea rdx, [0x14011037c]
test byte [rcx + 0x140], 1
mov dword [rcx + 0x40], eax
jne 0x14006a74e
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
mov rbx, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2c0]
add rsp, 0x290
pop r14
pop rdi
pop rbp
ret
lea r9, [0x1400fb87c]
xor r8d, r8d
mov rcx, rbp
call fcn.140050b90
jmp 0x14006a732
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [rsp + 0x5c]
mov eax, dword [rsp + 0x60]
shl rcx, 0x20
or rcx, rax
mov qword [rsp + 0x2b8], rcx
movzx ebx, word [r14]
test ebx, 0xffffff80
je 0x14006a792
xor eax, eax
jmp 0x14006a7a6
mov edx, 2
mov ecx, ebx
call fcn.1400d7464
mov rcx, qword [rsp + 0x2b8]
mov edx, ebx
and edx, 0xffffffdf
test eax, eax
cmove edx, ebx
cmp edx, 0x4b
je 0x14006a7ce
cmp edx, 0x4d
jne 0x14006a7e8
mov rax, rcx
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
jmp 0x14006a7e0
mov rax, rcx
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
mov qword [rsp + 0x2b8], rax
mov rax, qword [0x14012fc08]
lea rdx, [0x1400fb96c]
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov dword [rax + 0x40], 0
lea r8, [r9 - 1]
call fcn.1400b0830
mov rdx, qword [rsp + 0x2b8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, qword [0x140136490]
call fcn.1400014b0
mov eax, 1
jmp 0x14006a732
mov rax, qword [0x14012fc08]
lea rdx, [0x14011037c]
test byte [rax + 0x140], 1
mov dword [rax + 0x40], 0x57
jne 0x14006a878
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
add rsp, 0x290
pop r14
pop rdi
pop rbp
ret
lea r9, [0x1400fb87c]
xor r8d, r8d
mov rcx, rbp
call fcn.140050b90
add rsp, 0x290
pop r14
pop rdi
pop rbp
ret
Function at 0x14007de70
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cl
test cl, cl
jne 0x14007de85
xor al, al
add rsp, 0x20
pop rbx
ret
sub edx, 1
je 0x14007deb0
mov ecx, ebx
cmp edx, 1
je 0x14007dea2
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
add rsp, 0x20
pop rbx
ret
lea eax, [rbx - 1]
cmp al, 5
ja 0x14007debc
cmp bl, 3
jne 0x14007dec3
lea eax, [rbx + 0x66]
cmp al, 5
ja 0x14007dee0
cmp qword [0x140134260], 0
jne 0x14007df02
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x20
pop rbx
ret
cmp qword [0x140134268], 0
je 0x14007decd
xor edx, edx
xor r8d, r8d
movzx ecx, bl
call fcn.1400216b0
test al, al
je 0x14007df02
mov cl, 1
call fcn.140021430
lea rcx, [0x140135010]
movzx eax, byte [rbx + rcx]
shr al, 7
add rsp, 0x20
pop rbx
ret

Function at 0x14007e350
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rdi, rdx
mov esi, ecx
mov r8d, ecx
xor r15d, r15d
mov word [rdx], r15w
mov ecx, 0x410
xor edx, edx
movzx ebx, r9b
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x14007e3aa
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14007e4fc
xor edx, edx
mov qword [rsp + 0x250], rbp
mov r9d, 0x104
mov r8, rdi
mov rcx, r14
test bl, bl
je 0x14007e3cc
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
jmp 0x14007e3d2
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ebp, eax
test eax, eax
jne 0x14007e4e9
mov rax, qword [0x140119e28]
test rax, rax
je 0x14007e4e9
mov r8d, 0x104
mov rdx, rdi
mov rcx, r14
call rax
mov ebp, eax
test eax, eax
je 0x14007e4e9
test bl, bl
je 0x14007e443
mov edx, 0x5c
mov rcx, rdi
call fcn.1400cba50
test rax, rax
je 0x14007e4e9
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x14007e425
add r8, r8
lea rdx, [rax + 2]
mov rcx, rdi
call fcn.1400cfd20
jmp 0x14007e4e9
mov eax, 0x41
mov dword [rsp + 0x25a], 0x3a
mov word [rsp + 0x258], ax
nop dword [rax + rax]
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ebx, eax
cmp eax, 2
jbe 0x14007e4a2
add ebx, 0xfffffffe
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov rdx, rdi
call fcn.1400dceb8
test eax, eax
jne 0x14007e4a2
cmp word [rdi + rbx*2], 0x5c
lea rdx, [rdi + rbx*2]
je 0x14007e4bd
movzx eax, word [rsp + 0x258]
inc ax
mov word [rsp + 0x258], ax
cmp ax, 0x5a
jbe 0x14007e460
jmp 0x14007e4e9
movzx eax, word [rsp + 0x258]
lea rcx, [rdi + 4]
mov word [rdi], ax
sub ebp, ebx
movzx eax, word [rsp + 0x25a]
mov word [rdi + 2], ax
lea r8d, [rbp + 1]
add r8, r8
call fcn.1400cfd20
add ebp, 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rbp, qword [rsp + 0x250]
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400819b0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x280
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x140081adc
cmp word [rdx], 0
je 0x140081adc
lea r9, [rsp + 0x298]
mov edx, 0x104
lea r8, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140081a00
xor edx, edx
test rax, rax
je 0x140081a1e
cmp word [rsp + rax*2 + 0x6e], 0x5c
jne 0x140081a1e
mov word [rsp + rax*2 + 0x6e], dx
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], dx
lea rax, [rax + 1]
jne 0x140081a30
mov word [rsp + rax*2 + 0x72], dx
lea rcx, [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x54], edx
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
mov eax, 0x4054
mov qword [rsp + 0x30], rdx
mov word [rsp + 0x50], ax
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x38], 3
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x140081aaa
mov rcx, qword [0x140134210]
lea rdx, [0x1400fb96c]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
add rsp, 0x280
pop rbx
ret
mov rax, qword [0x14012fc08]
lea rdx, [0x14011037c]
test byte [rax + 0x140], 1
je 0x140081af3
mov rcx, rbx
lea r9, [0x1400fb87c]
xor r8d, r8d
call fcn.140050b90
add rsp, 0x280
pop rbx
ret
mov rax, qword [0x14012fc08]
lea rdx, [0x14011037c]
test byte [rax + 0x140], 1
jne 0x140081ac4
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
add rsp, 0x280
pop rbx
ret

Function at 0x140081b20
Capabilities:
Empty the recycle bin

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
cmp word [rdx], ax
mov r8d, 7
cmovne rax, rdx
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
test eax, eax
jne 0x140081b6c
mov rcx, qword [0x140134210]
lea rdx, [0x1400fb96c]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
add rsp, 0x30
pop rbx
ret
mov rax, qword [0x14012fc08]
lea rdx, [0x14011037c]
test byte [rax + 0x140], 1
jne 0x140081ba1
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
add rsp, 0x30
pop rbx
ret
lea r9, [0x1400fb87c]
xor r8d, r8d
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.140050b90
Function at 0x140081bc0
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
sub rsp, 0x148
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rbx, rdx
mov rbp, rcx
mov rcx, qword [0x140136490]
xor edx, edx
lea r8, [r9 - 1]
call fcn.1400b0830
test rbx, rbx
je 0x140081de1
cmp word [rbx], 0
je 0x140081de1
lea rdx, [rsp + 0x168]
mov qword [rsp + 0x140], rdi
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
jne 0x140081c8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14012fc08]
lea rdx, [0x14011037c]
test byte [rcx + 0x140], 1
mov dword [rcx + 0x40], eax
jne 0x140081c66
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
mov rdi, qword [rsp + 0x140]
add rsp, 0x148
pop rbp
pop rbx
ret
lea r9, [0x1400fb87c]
xor r8d, r8d
mov rcx, rbp
call fcn.140050b90
mov rdi, qword [rsp + 0x140]
add rsp, 0x148
pop rbp
pop rbx
ret
mov rcx, rdi
mov qword [rsp + 0x160], rsi
call fcn.1400d29a0
mov r9, rax
mov r8d, edi
xor edx, edx
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140081d89
lea r9, [rsp + 0x170]
mov rcx, rsi
lea r8, [rsp + 0x178]
lea rdx, [0x140111380]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140081d89
mov rax, qword [rsp + 0x178]
lea r8, str._u._u._u._u
mov edx, dword [rax + 0xc]
mov r9d, dword [rax + 8]
movzx ecx, dx
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x40]
shr edx, 0x10
mov dword [rsp + 0x28], edx
mov edx, 0x80
movzx eax, r9w
shr r9d, 0x10
mov dword [rsp + 0x20], eax
call fcn.1400acf50
mov rcx, rsi
call fcn.1400d29a8
mov rax, qword [0x14012fc08]
lea rdx, [0x1400fb96c]
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov dword [rax + 0x40], 0
lea r8, [r9 - 1]
call fcn.1400b0830
mov rcx, qword [0x140136490]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
mov rsi, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x140]
add rsp, 0x148
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14012fc08]
mov dword [rcx + 0x40], eax
mov rcx, rsi
call fcn.1400d29a8
mov rax, qword [0x14012fc08]
lea rdx, [0x14011037c]
test byte [rax + 0x140], 1
jne 0x140081dcd
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
jmp 0x140081d6a
lea r9, [0x1400fb87c]
xor r8d, r8d
mov rcx, rbp
call fcn.140050b90
jmp 0x140081d6f
mov rax, qword [0x14012fc08]
lea rdx, [0x14011037c]
test byte [rax + 0x140], 1
mov dword [rax + 0x40], 0x57
jne 0x140081e21
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
add rsp, 0x148
pop rbp
pop rbx
ret
lea r9, [0x1400fb87c]
xor r8d, r8d
mov rcx, rbp
call fcn.140050b90
add rsp, 0x148
pop rbp
pop rbx
ret
Function at 0x140082110
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
cmp word [rcx], 0
je 0x140082214
test dl, dl
jne 0x14008214c
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140082214
mov al, 1
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
lea r9, [rsp + 0x280]
mov edx, 0x104
lea r8, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x140082173
xor edi, edi
test rax, rax
je 0x140082191
cmp word [rsp + rax*2 + 0x5e], 0x5c
jne 0x140082191
mov word [rsp + rax*2 + 0x5e], di
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140082214
test al, 0x10
je 0x140082214
lea rax, [rsp + 0x60]
nop word [rax + rax]
cmp word [rax + rbx*2 + 2], di
lea rbx, [rbx + 1]
jne 0x1400821b0
lea rax, [rsp + 0x60]
mov word [rsp + rbx*2 + 0x62], di
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov eax, 0x614
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
mov word [rsp + 0x40], ax
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
mov rbx, qword [rsp + 0x288]
xor al, al
add rsp, 0x270
pop rdi
ret