joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006c4e0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov r8, r10
mov rdx, r11
mov rbx, rcx
call fcn.14007cfe0
mov rdi, rax
test rax, rax
je 0x14006c61d
mov rdx, rsi
mov rcx, rax
call fcn.1400d8150
mov rsi, rax
test rax, rax
je 0x14006c61d
mov qword [rsp + 0x40], rbp
xor edx, edx
mov rcx, rdi
xor bpl, bpl
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
test eax, eax
je 0x14006c57f
cmp eax, dword [0x140163c90]
je 0x14006c57f
mov rcx, rdi
call fcn.1400d86f0
test al, al
jne 0x14006c57f
mov ecx, dword [0x140163c90]
mov r8d, 1
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bpl
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetFocus]
test rax, rax
je 0x14006c5ed
mov rcx, qword [0x140160738]
lea rdx, [0x14012054c]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400d5e90
mov rax, qword [0x14015bc10]
cmp dword [rax + 0x78], 0xffffffff
jle 0x14006c5ed
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140163c90], eax
je 0x14006c5d9
mov rax, qword [0x14015bc10]
mov ecx, dword [rax + 0x78]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14006c5ed
mov rcx, qword [0x14015bc10]
mov edx, 1
mov ecx, dword [rcx + 0x78]
call fcn.140001a10
test bpl, bpl
mov rbp, qword [rsp + 0x40]
je 0x14006c608
mov ecx, dword [0x140163c90]
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dl, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.1400629e0

Function at 0x14006d0f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov rbx, rdx
mov qword [rsp + 0x20], rax
mov r8, r10
mov rdx, r11
call fcn.14007cfe0
test rax, rax
je 0x14006d136
lea rdx, str.msctls_statusbar321
mov rcx, rax
call fcn.1400d8150
mov rdi, rax
jmp 0x14006d138
xor edi, edi
mov rax, rbx
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, 0x20
je 0x14006d14f
cmp cx, 9
jne 0x14006d155
add rax, 2
jmp 0x14006d140
test cx, cx
je 0x14006d1a5
cmp cx, 0x2d
je 0x14006d166
cmp cx, 0x2b
jne 0x14006d170
lea rcx, [rax + 2]
mov rax, rcx
movzx ecx, word [rcx]
cmp cx, 0x30
jne 0x14006d1a5
movzx ecx, word [rax + 2]
mov edx, 0xffdf
sub cx, 0x58
test dx, cx
jne 0x14006d1a5
movzx ecx, word [rax + 4]
call fcn.1400f57c0
test eax, eax
je 0x14006d1a5
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x10]
call fcn.1400f7190
jmp 0x14006d1ad
mov rcx, rbx
call fcn.1400f73ac
mov rcx, qword [0x140162ac0]
lea r9, [0x14012046c]
mov dword [rsp + 0x68], getservbyport
mov r8d, eax
mov rdx, rdi
mov dword [rsp + 0x60], 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400d7cf0
Function at 0x14006e710
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x60]
mov rbx, qword [0x140162ac0]
mov qword [rsp + 0x20], rax
call fcn.14007cfe0
mov rsi, rax
mov ebp, 1
test rax, rax
je 0x14006e755
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
jmp 0x14006e757
mov edi, ebp
lea eax, [rdi - 1]
mov byte [rsp + 0x20], bpl
movsxd r8, eax
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call fcn.1400d5e90
cmp eax, ebp
je 0x14006e77a
xor eax, eax
jmp 0x14006e894
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
test rsi, rsi
je 0x14006e827
mov qword [rsp + 0x40], r14
call fcn.140001770
mov rdx, rax
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [rbx + 0x23], 0
movsxd r14, eax
jne 0x14006e7b3
mov rsi, qword [rbx + 0x10]
jmp 0x14006e7b6
mov rsi, rbx
lea rdi, [0x1401662d0]
cmp byte [rsi + 0x23], bpl
jne 0x14006e7d7
test byte [rsi + 0x21], 8
je 0x14006e7d1
mov rcx, rsi
call fcn.140001610
add rsi, 0x10
jmp 0x14006e7da
mov rsi, rdi
lea rax, [r14 + r14]
mov r14, qword [rsp + 0x40]
mov qword [rsi], rax
cmp byte [rbx + 0x23], 0
jne 0x14006e7f2
mov rsi, qword [rbx + 0x10]
jmp 0x14006e7f5
mov rsi, rbx
cmp byte [rsi + 0x23], bpl
jne 0x14006e80d
test byte [rsi + 0x21], 8
je 0x14006e809
mov rcx, rsi
call fcn.140001610
lea rdi, [rsi + 0x10]
cmp qword [rdi], 2
jae 0x14006e864
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.140001770
xor esi, esi
mov word [rax], si
jmp 0x14006e864
call fcn.140001770
xor esi, esi
mov word [rax], si
cmp byte [rbx + 0x23], sil
jne 0x14006e83d
mov rdi, qword [rbx + 0x10]
jmp 0x14006e840
mov rdi, rbx
cmp byte [rdi + 0x23], bpl
jne 0x14006e85a
test byte [rdi + 0x21], 8
je 0x14006e854
mov rcx, rdi
call fcn.140001610
add rdi, 0x10
jmp 0x14006e861
lea rdi, [0x1401662d0]
mov qword [rdi], rsi
cmp byte [rbx + 0x23], 0
jne 0x14006e86e
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x14006e88e
cmp qword [0x140164960], 0
je 0x14006e88e
lea rcx, [0x140164948]
call fcn.140007590
mov ebp, eax
jmp 0x14006e892
and byte [rbx + 0x21], 0x86
mov eax, ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14006e920
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
mov eax, 0x11cf0
call fcn.1401119a0
sub rsp, rax
xor eax, eax
mov byte [rsp + 0x1889], 1
mov rbx, rcx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x188c], eax
lea rcx, [0x14012046c]
mov qword [rsp + 0x18a0], rax
cmp edx, 6
mov rdx, qword [0x14015bc10]
xorps xmm0, xmm0
mov dword [rsp + 0x18a8], eax
mov qword [rsp + 0x18b0], rax
mov qword [rsp + 0x18c8], rax
cmove rax, rbx
mov qword [rsp + 0x18c0], rax
mov rax, qword [rsp + 0x11d28]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x11d20]
mov qword [rsp + 0x1048], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
movdqa xmmword [rsp + 0x1890], xmm0
call fcn.1400d8980
test eax, eax
je 0x14006e9d1
lea rdx, [rsp + 0x30]
lea rcx, [0x1400d7990]
call qword [sym.imp.USER32.dll_EnumWindows]
movsxd rdx, dword [rsp + 0x188c]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.140001570
mov eax, 1
add rsp, 0x11cf0
pop rbx
ret

Function at 0x14006f930
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
mov eax, 0x10030
call fcn.1401119a0
sub rsp, rax
mov rbx, qword [0x140162ac0]
mov rbp, rdx
mov rcx, rbp
lea rdx, [rsp + 0x30]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov byte [rsp + 0x20], 1
mov rcx, rbx
mov esi, eax
cmp eax, 0x7fff
jb 0x14006fa12
lea r8d, [rsi - 1]
mov r9b, 1
xor edx, edx
call fcn.1400d5e90
test eax, eax
je 0x14006fa2f
mov qword [rsp + 0x10040], rdi
xor r8d, r8d
mov edi, 1
mov rcx, rbx
mov edx, edi
call fcn.140001770
mov rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x14006f9d0
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.140001770
xor ecx, ecx
mov word [rax], cx
cmp byte [rbx + 0x23], 0
jne 0x14006f9da
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x14006fa02
cmp qword [0x140164960], 0
je 0x14006fa02
lea rcx, [0x140164948]
call fcn.140007590
mov edi, eax
mov rdi, qword [rsp + 0x10040]
jmp 0x14006fa2f
and byte [rbx + 0x21], 0x86
mov eax, edi
mov rdi, qword [rsp + 0x10040]
jmp 0x14006fa2f
test esi, esi
lea rax, [0x14012046c]
lea rdx, [rsp + 0x30]
mov r8, rsi
cmove rdx, rax
xor r9d, r9d
call fcn.1400d5e90
lea r11, [rsp + 0x10030]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x140072ce0
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
push r14
push r15
sub rsp, 0x250
mov rbp, r9
mov qword [rsp + 0x20], r8
mov r9, qword [0x140164890]
mov r15, r8
lea r8, str.__s_s
mov edx, 0x800
mov r14, rcx
call fcn.1400d08d0
movsxd rbx, eax
lea edi, [rbx + 1]
cmp edi, 0x800
jg 0x140072d6f
lea rcx, [r14 + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140072d6f
movsxd rax, edi
mov ecx, SafeArrayAllocDescriptor
mov word [r14 + rbx*2], cx
xor edi, edi
mov rcx, qword [rsp + 0x290]
mov word [r14 + rax*2], di
mov rax, qword [0x140164890]
mov qword [rcx], rax
mov al, 1
jmp 0x140072f0a
xor edi, edi
mov esi, edi
mov r9d, esi
lea rax, [rsp + 0x30]
or r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREAutoHotkey
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140072eef
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x278]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallDir
lea rax, [rsp + 0x40]
mov dword [rsp + 0x278], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140072eef
mov eax, dword [rsp + 0x278]
test eax, eax
je 0x140072eef
shr eax, 1
mov r8d, eax
dec eax
mov edx, eax
mov dword [rsp + 0x278], eax
cmp word [rsp + rax*2 + 0x40], di
jne 0x140072e38
test eax, eax
je 0x140072ef6
dec edx
cmp word [rsp + rdx*2 + 0x40], di
jne 0x140072e56
mov dword [rsp + 0x278], edx
mov eax, edx
test edx, edx
jne 0x140072e20
jmp 0x140072e56
mov dword [rsp + 0x278], r8d
cmp r8d, 0x104
jae 0x140072eef
mov word [rsp + r8*2 + 0x40], di
mov eax, r8d
test eax, eax
je 0x140072ef6
test rbp, rbp
je 0x140072e91
lea rcx, [rsp + 0x40]
mov r9, rbp
sub r9, rcx
lea rdx, [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx]
mov word [r9 + rdx], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x140072e80
test eax, eax
je 0x140072f08
mov r9, rbp
mov qword [rsp + 0x20], r15
lea r8, str.__s_s
mov edx, 0x800
mov rcx, r14
call fcn.1400d08d0
movsxd rbx, eax
lea esi, [rbx + 1]
cmp esi, 0x800
jg 0x140072f08
lea rcx, [r14 + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140072f08
movsxd rax, esi
mov ecx, SafeArrayAllocDescriptor
mov word [r14 + rbx*2], cx
mov word [r14 + rax*2], di
mov rax, qword [rsp + 0x290]
mov qword [rax], rbp
mov al, 1
jmp 0x140072f0a
mov word [rsp + 0x40], di
mov eax, edi
test esi, esi
jne 0x140072e5e
mov esi, 0x200
jmp 0x140072d73
xor al, al
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140072f30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2260
call fcn.1401119a0
sub rsp, rax
lea rax, [rsp + 0x2290]
mov r8, rcx
lea rcx, [rsp + 0x1260]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
movzx esi, dl
lea rbx, [rsp + 0x1260]
lea rdi, [0x14012046c]
call fcn.140072ce0
test al, al
jne 0x140072f84
add rsp, 0x2260
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x2298], r15
xor r15d, r15d
test sil, sil
je 0x140073046
mov rsi, qword [rsp + 0x2290]
lea rax, [0x140141870]
mov r9, rsi
mov qword [rsp + 0x2280], rbp
lea r8, str.__s_s
mov qword [rsp + 0x2288], r14
mov edx, 0x800
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x260]
call fcn.1400d08d0
movsxd rbp, eax
lea r14d, [rbp + 1]
cmp r14d, 0x800
jg 0x14007301e
lea rcx, [rsp + 0x262]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007301e
movsxd rax, r14d
lea rbx, [rsp + 0x260]
mov ecx, SafeArrayAllocDescriptor
mov word [rsp + rbp*2 + 0x260], cx
mov word [rsp + rax*2 + 0x260], r15w
jmp 0x14007302e
cmp rsi, qword [0x140164890]
jne 0x140073036
mov rbx, qword [0x140164888]
lea rdi, [rsp + 0x1260]
mov rbp, qword [rsp + 0x2280]
mov r14, qword [rsp + 0x2288]
mov qword [rsp + 0x48], r15
lea rcx, [0x140163cc0]
mov byte [rsp + 0x40], r15b
xor r9d, r9d
mov byte [rsp + 0x38], r15b
mov r8, rdi
mov qword [rsp + 0x30], r15
mov rdx, rbx
mov qword [rsp + 0x28], r15
mov byte [rsp + 0x20], r15b
call fcn.1400648c0
mov r15, qword [rsp + 0x2298]
test eax, eax
setne al
add rsp, 0x2260
pop rdi
pop rsi
pop rbx
ret
Function at 0x140077ce0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
sub rsp, 0x250
mov rbp, qword [0x140162ac0]
xor ecx, ecx
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140024340
movzx r14d, al
test al, al
jne 0x140077d7f
xor r8d, r8d
lea rdx, [rsp + 0x270]
mov rcx, rbx
call fcn.140094910
xor r9d, r9d
test eax, eax
jne 0x140077d4a
lea rdx, [0x14012046c]
jmp 0x140077dec
mov edx, dword [rsp + 0x270]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x30]
xor edi, edi
mov ecx, eax
mov dword [rsp + 0x40], edi
call fcn.140094dd0
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400d5540
jmp 0x140077e00
mov qword [rsp + 0x278], rsi
mov ebx, 2
movzx esi, word [rdi]
xor edi, edi
test esi, 0xffffff80
je 0x140077d9d
mov eax, edi
jmp 0x140077da6
mov edx, ebx
mov ecx, esi
call fcn.1400fc354
mov ecx, esi
and ecx, 0xffffffdf
test eax, eax
cmove ecx, esi
mov rsi, qword [rsp + 0x278]
cmp ecx, 0x50
je 0x140077dc5
cmp ecx, 0x54
cmovne ebx, edi
jmp 0x140077dca
mov ebx, 1
mov edx, ebx
movzx ecx, r14b
call fcn.140094d20
test al, al
lea rcx, [0x140141c78]
lea rdx, [0x140141c7c]
cmovne rdx, rcx
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
mov rcx, rbp
call fcn.1400d5e90
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rdi
pop rbp
ret

Function at 0x140077e20
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
xor r9d, r9d
mov byte [rsp + 0x20], 1
movzx esi, r8b
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov rcx, qword [0x140162ac0]
lea r8, [r9 - 1]
call fcn.1400d5e90
test rbx, rbx
je 0x140077f32
cmp word [rbx], 0
je 0x140077f32
mov r8d, 0x103
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.1401020c4
xor edx, edx
lea rcx, [rsp + 0x40]
mov word [rsp + 0x246], dx
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], dx
jne 0x140077e92
lea rcx, [rax + rax]
cmp word [rsp + rcx + 0x3e], 0x5c
je 0x140077ebe
inc rax
cmp rax, 0x104
jae 0x140077f32
mov dword [rsp + rcx + 0x40], 0x5c
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x268]
lea rdx, [rsp + 0x278]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x140077f32
mov rbx, qword [rsp + 0x268]
lea rdx, [0x14012054c]
mov rcx, qword [0x140160738]
test sil, sil
mov byte [rsp + 0x20], 1
cmovne rbx, qword [rsp + 0x278]
xor r9d, r9d
shr rbx, 0x14
lea r8, [r9 - 1]
call fcn.1400d5e90
mov rcx, qword [0x140162ac0]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, rbx
call fcn.140001570
mov eax, 1
jmp 0x140077f3c
mov dl, 1
mov rcx, rdi
call fcn.1400629e0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14007a0d0
Capabilities:
Set current directory

Disassembly:
push rbx
sub rsp, 0x30
movzx eax, word [rcx]
mov rbx, rcx
test ax, ax
je 0x14007a108
cmp word [rcx + 2], 0x3a
jne 0x14007a108
cmp word [rcx + 4], 0
jne 0x14007a108
mov word [rsp + 0x40], ax
lea rbx, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x42], 0x5c003a
mov word [rsp + 0x46], ax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x14007a150
cmp byte [0x1401648a0], al
je 0x14007a180
mov rax, qword [0x14015bc10]
lea rdx, [0x140136e9c]
test byte [rax + 0x140], 1
je 0x14007a168
mov rcx, qword [0x140164390]
lea r9, [0x14012046c]
xor r8d, r8d
call fcn.140062910
add rsp, 0x30
pop rbx
ret
cmp byte [0x1401648a0], 0
je 0x14007a180
mov rcx, rbx
call fcn.14007a190
lea rdx, [0x14012054c]
mov rcx, qword [0x140160738]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400d5e90
add rsp, 0x30
pop rbx
ret

Function at 0x14007a190
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x10020
call fcn.1401119a0
sub rsp, rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x8000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14007a1bd
lea rbx, [rsp + 0x20]
jmp 0x14007a1c2
test rbx, rbx
je 0x14007a1d1
mov rdx, rbx
lea rcx, vtable.CKuStringT_wchar_t__class_CKuStringUtilW_.0
call fcn.1400953f0
add rsp, 0x10020
pop rbx
ret

Function at 0x14007a1e0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10028
call fcn.1401119a0
sub rsp, rax
lea rdx, [rsp + 0x20]
mov ecx, 0x8000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14007a213
lea rcx, [rsp + 0x20]
call fcn.140101a30
add rsp, 0x10028
ret
xor eax, eax
add rsp, 0x10028
ret
Function at 0x14007ab20
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rdi
mov rdi, rcx
mov qword [rbp + 0x28], r14
mov r14, rdx
test rcx, rcx
je 0x14007ac2b
cmp word [rcx], 0
je 0x14007ac2b
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14007ab7a
mov ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_SetLastError]
shr ebx, 4
and bl, 1
movzx eax, bl
jmp 0x14007ac38
mov ebx, 0x5c
mov rcx, rdi
mov edx, ebx
call fcn.1400f0974
mov rsi, rax
cmp rax, rdi
jbe 0x14007ac19
cmp word [rax - 2], 0x3a
je 0x14007ac19
test r14, r14
je 0x14007abb6
xor eax, eax
mov rdx, rdi
mov rcx, rdi
mov word [rsi], ax
call fcn.14007ab20
mov word [rsi], bx
jmp 0x14007ac0e
mov r14, rsi
sub r14, rdi
sar r14, 1
lea rax, [r14*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14007abda
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401119a0
sub rsp, rcx
mov r8, r14
mov rdx, rdi
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.1401020c4
xor eax, eax
mov rdx, rbx
mov rcx, rbx
mov word [rbx + r14*2], ax
call fcn.14007ab20
cmp word [rsi + 2], 0
je 0x14007ac38
test al, al
je 0x14007ac38
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
jmp 0x14007ac38
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x20]
mov r14, qword [rbp + 0x28]
mov rsp, rbp
pop rbp
ret
Function at 0x14007bb70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, r8
mov r14, rdx
mov r15, rcx
test r8, r8
je 0x14007bbd9
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.140001770
cmp byte [rdi + 0x23], 0
mov rsi, rax
jne 0x14007bbac
mov rbx, qword [rdi + 0x10]
jmp 0x14007bbaf
mov rbx, rdi
cmp byte [rbx + 0x23], 1
jne 0x14007bbcd
test byte [rbx + 0x21], 8
je 0x14007bbc3
mov rcx, rbx
call fcn.140001610
mov rbp, qword [rbx + 0x10]
add rbx, 0x10
jmp 0x14007bc23
lea rbx, [0x1401662d0]
mov rbp, qword [rbx]
jmp 0x14007bc23
lea r8, [rsp + 0x88]
xor ecx, ecx
lea rdx, [rsp + 0x80]
call fcn.1400d5660
test eax, eax
jne 0x14007bc13
mov rax, qword [0x14015bc10]
xor ebx, ebx
mov dword [rax + 0x40], ebx
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0x40000000
mov rcx, r14
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14007bca4
mov dword [rsp + 0x80], ebx
mov ecx, ebx
test rsi, rsi
je 0x14007bc84
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rbx
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x80]
cmp ecx, ebp
setne bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14015bc10]
mov dword [rcx + 0x40], eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14007bcb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14015bc10]
mov ebx, 1
mov dword [rcx + 0x40], eax
test rdi, rdi
jne 0x14007bcc6
mov rcx, rsi
call fcn.1400f75c8
movzx edx, bl
mov rcx, r15
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp fcn.1400629e0

Function at 0x14007bd00
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
movzx r8d, word [rdx]
mov rbx, rdx
mov rdi, rcx
mov r9, rdx
test r8w, r8w
je 0x14007bd9d
test rdx, rdx
je 0x14007bd62
mov edx, 0x3f
nop dword [rax + rax]
lea rcx, [0x140142288]
movzx eax, dx
nop word [rax + rax]
cmp r8w, ax
je 0x14007bd9d
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14007bd40
movzx r8d, word [r9 + 2]
add r9, 2
test r8w, r8w
jne 0x14007bd30
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14015bc10]
movzx edx, bl
mov dword [rcx + 0x40], eax
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400629e0
xor r9d, r9d
mov qword [rsp + 0x28], 0
lea rax, [0x14007bcf0]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call fcn.14007c410
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14007c090
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x130
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rbx, rdx
mov rdi, rcx
mov rcx, qword [0x140162ac0]
xor edx, edx
lea r8, [r9 - 1]
call fcn.1400d5e90
test rbx, rbx
je 0x14007c1e9
cmp word [rbx], 0
je 0x14007c1e9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14007c0f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14015bc10]
mov dword [rcx + 0x40], eax
jmp 0x14007c1f7
mov rax, qword [0x14015bc10]
xor edx, edx
mov qword [rsp + 0x140], rsi
mov rcx, rdi
xor esi, esi
mov dword [rax + 0x40], esi
call fcn.1400629e0
mov ecx, ebx
and ecx, 1
je 0x14007c124
mov eax, 0x52
mov word [rsp + 0x30], ax
test bl, 0x20
je 0x14007c135
mov edx, 0x41
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
test bl, 4
je 0x14007c146
mov edx, 0x53
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
test bl, 2
je 0x14007c157
mov edx, 0x48
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
test bl, bl
jns 0x14007c167
mov edx, 0x4e
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
test bl, 0x10
je 0x14007c178
mov edx, 0x44
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
bt ebx, 0xc
jae 0x14007c18a
mov edx, 0x4f
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
bt ebx, 0xb
jae 0x14007c19c
mov edx, 0x43
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
bt ebx, 8
jae 0x14007c1ae
mov edx, 0x54
mov word [rsp + rcx*2 + 0x30], dx
inc ecx
xor r9d, r9d
mov word [rsp + rcx*2 + 0x30], si
mov rcx, qword [0x140162ac0]
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400d5e90
mov rsi, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rdi
ret
mov rax, qword [0x14015bc10]
mov dword [rax + 0x40], 0x57
mov dl, 1
mov rcx, rdi
call fcn.1400629e0
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rdi
ret