joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e0cc
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140061550]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r9d, dword [rcx + 8]
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
mov rdi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rsi, rcx
lea rcx, [rsp + 0x48]
or r9d, 0x2001f
call fcn.14000aab4
mov ebx, eax
test eax, eax
je 0x14000e183
cmp eax, 2
je 0x14000e1ea
cmp eax, 3
je 0x14000e1ea
mov rdx, qword [0x140063130]
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlbase.h
lea r9, str.CRegKey::RecurseDeleteKey_:_Failed_to_Open_Key__s_Error___d__n
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x166a
mov qword [rsp + 0x20], rdi
call fcn.14000a6e8
jmp 0x14000e1ea
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000e0cc
mov ebx, eax
test eax, eax
jne 0x14000e1ea
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x70]
xor edx, edx
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000e16e
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000e1d8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
mov rdx, rdi
mov rcx, rsi
call fcn.14000a904
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000e1fa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14001e4a0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000ecf8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x48
lea rdi, [0x140050348]
lea rdx, str.Inside_IsModifyRotCapsForDC
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x38], 0xb85
call fcn.140002184
xor ebx, ebx
lea rax, [rsp + 0x78]
lea rdx, str.SoftwareIntelDisplayigfxcuiigfxcfg
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x14000edbf
lea rdx, str.IsModifyRotCapsForDC_returned_SUCCESS
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x38], 0xb8b
call fcn.140002184
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
lea rdx, str.DCRotationCaps
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x68], 1
sete bl
mov eax, ebx
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x14000f1dc
Capabilities:
Get geographical location
Identify system language via api
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x60
and qword [rax + 0x10], 0
and dword [rax + 8], 0
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor r9d, r9d
movzx ebx, ax
xor r8d, r8d
lea edx, [r9 + 3]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
lea r8d, [rax + 1]
movsxd rcx, r8d
call fcn.14001cbd0
mov r9d, esi
mov edx, 3
mov r8, rax
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea r11, [rsp + 0x70]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, str.SoftwareIntelDisplayigfxcuihkcmd_resources
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000f2d1
mov rcx, qword [rsp + 0x78]
lea r9d, [rax + 1]
lea rdx, str.UserLangID
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14000f2c4
lea rax, [0x140050348]
lea rdx, str.ERROR:_Couldnt_set_the_registry_value_for_registry_User_Language_in_File:_persistence.cpp_r_n
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x11eb
call fcn.140002184
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000f2f6
lea rax, [0x140050348]
lea rdx, str.ERROR:_Couldnt_Open_regsitry_szMUIRegPath_in_File:_persistence.cpp_r_n
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x11f2
call fcn.140002184
test rdi, rdi
je 0x14000f303
mov rcx, rdi
call fcn.14001d230
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000f318
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x140061550]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov ebx, ecx
lea rdi, [0x140050348]
lea rdx, str.Inside_Close_CUI_Applications
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x30], 0x1a1e
mov qword [rsp + 0x28], rdi
call fcn.140002184
cmp ebx, 1
je 0x14000f3fb
lea rdx, str.igfxtrayWindow
lea rcx, str.igfxtrayClass
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000f3b1
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 2]
call qword [sym.imp.USER32.dll_PostMessageA]
lea rdx, str.Inside_Close_CUI_Applications:_Closed_Tray
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0x1a28
call fcn.140002184
lea rdx, str.HkWndName
lea rcx, str.HkClass
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000f3fb
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 2]
call qword [sym.imp.USER32.dll_PostMessageA]
lea rdx, str.Inside_Close_CUI_Applications:_Closed_hkcmd
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0x1a31
call fcn.140002184
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x12c
call fcn.14001dda0
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov dword [rsp + 0x40], 0x130
call sub.KERNEL32.dll_Process32First
lea rdx, str.GfxUI.exe
lea rcx, [rsp + 0x6c]
call fcn.140021ca0
test eax, eax
je 0x14000f462
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x14000f492
jmp 0x14000f43a
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14001e4a0
mov rbx, qword [rsp + 0x190]
add rsp, 0x180
pop rdi
ret
Function at 0x14000f708
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x580
mov rax, qword [0x140061550]
xor rax, rsp
mov qword [rsp + 0x570], rax
mov rbx, rcx
lea rbp, [0x140050348]
lea rdx, str.Inside_ICC:_CheckCreateDirectory__._n
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x40], 0x1db1
mov qword [rsp + 0x38], rbp
call fcn.140002184
lea rcx, [rsp + 0x160]
xor edx, edx
mov r8d, 0x104
call fcn.14001dda0
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
call fcn.14001dda0
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 3]
call fcn.14001dda0
mov edi, 0x100
lea rcx, [rsp + 0x470]
mov r8, rdi
xor edx, edx
call fcn.14001dda0
lea rcx, [rsp + 0x270]
mov r8, rdi
xor edx, edx
call fcn.14001dda0
lea rcx, [rsp + 0x370]
mov r8, rdi
xor edx, edx
call fcn.14001dda0
lea edx, [rdi + 4]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x14000f802
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x40], 0x1dbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.LastError___ld._n
lea rcx, [rsp + 0x38]
mov r8d, eax
call fcn.140002184
lea rax, [rsp + 0x370]
lea r9, [rsp + 0x270]
lea r8, [rsp + 0x470]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x160]
mov qword [rsp + 0x20], rax
call fcn.1400225e0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14001e3d0
lea rdx, [0x140050b5c]
lea rcx, [rsp + 0x50]
call fcn.14001e330
lea rdx, str.ProgramDataIntelExtremeGraphics
lea rcx, [rsp + 0x50]
call fcn.14001e330
lea rdx, [0x140050b5c]
lea rcx, [rsp + 0x50]
call fcn.14001e330
lea rdx, str.CUIResource
lea rcx, [rsp + 0x50]
call fcn.14001e330
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x14000f8e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, VarDecFix
cmp eax, edi
je 0x14000f8e3
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140021ca0
test eax, eax
je 0x14000f8df
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14001e3d0
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x14000f8e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x14000f8e3
xor al, al
jmp 0x14000f8e5
mov al, 1
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.14001e4a0
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001288c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x170
lea rbp, [0x140050348]
lea rdx, str.Inside_Launch_CUI_Applications
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x58], 0x1a5a
call fcn.140002184
xor ebx, ebx
lea rdi, str.igfxtray.exe
cmp ebx, 1
jne 0x1400128f8
lea rdx, str.Inside_Launch_CUI_Applications:_Launching_hkcmd
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x58], 0x1a63
call fcn.140002184
lea rdi, str.hkcmd.exe
jmp 0x140012916
lea rdx, str.Inside_Launch_CUI_Applications:_Launching_igfxtray
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x68], 0x1a68
call fcn.140002184
xor edx, edx
lea rcx, [rsp + 0x100]
lea r8d, [rdx + 0x68]
call fcn.14001dda0
lea rax, [rsp + 0xe0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x100]
xor r8d, r8d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], 0x4000020
and dword [rsp + 0x20], 0
mov dword [rsp + 0x100], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400129c3
lea r8d, [rax + 0x70]
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.14001dda0
and qword [rsp + 0x90], 0
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x70
mov dword [rsp + 0x74], 0x440
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0xa0], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
inc ebx
cmp ebx, 2
jl 0x1400128c5
cmp qword [0x140062f40], 0
jne 0x1400129dd
call fcn.14001212c
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140022ce0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140022d04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x140022d0c
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
je 0x140022d23
mov ecx, dword [rsp + 0x20]
call fcn.1400276a0
mov eax, 0xffffffff
jmp 0x140022d25
xor eax, eax
add rsp, 0x38
ret

Function at 0x140029817
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140061550]
jne 0x14001e4ba
rol rcx, 0x10
test cx, 0xffff
jne 0x14001e4b6
repz ret
ror rcx, 0x10
jmp 0x140029770
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140063710]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140063808]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400297f5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140063710]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140029817
mov rax, qword [rsp + 0x88]
mov qword [0x140063808], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400637a8], rax
mov rax, qword [0x140063808]
mov qword [0x140063680], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140063790], rax
mov dword [0x140063670], 0xc0000409
mov dword [0x140063674], 1
mov rax, qword [0x140061550]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140061558]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140063708], eax
mov ecx, 1
call fcn.140036070
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140055df8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140063708], 0
jne 0x14002989e
mov ecx, 1
call fcn.140036070
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140004588
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400043b4

Function at 0x140fdf058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140fdf1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140fdf089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fdf06f
add dl, dl
jne 0x140fdf096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fdf0f6
xor eax, eax
add dl, dl
jne 0x140fdf0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fdf1ad
add dl, dl
jne 0x140fdf0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fdf0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fdf0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fdf0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140fdf0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140fdf07e
mov eax, 1
add dl, dl
jne 0x140fdf106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fdf113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fdf0fb
sub eax, ebx
mov ebx, 1
jne 0x140fdf14c
mov ecx, 1
add dl, dl
jne 0x140fdf12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140fdf13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fdf123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fdf07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140fdf168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140fdf175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fdf15d
cmp eax, 0x7d00
jae 0x140fdf19b
cmp eax, 0x500
jb 0x140fdf196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fdf07e
cmp eax, 0x7f
ja 0x140fdf19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fdf07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140fdf1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140fdf07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180007980
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1800130c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov rcx, qword [0x180013640]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800079c8
nop dword [rax]
cmp dword [rax + 0x20], 4
jge 0x1800079bc
mov rax, qword [rax + 0x10]
jmp 0x1800079c2
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800079b0
cmp byte [rcx + 0x19], 0
jne 0x180007aa4
cmp dword [rcx + 0x20], 4
jg 0x180007aa4
lea r8, [rcx + 0x28]
mov r10, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x1800079f1
mov rdx, qword [r8]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x180007a23
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r10
jb 0x180007a10
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180007350
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180007a5e
cmp rcx, qword [rbx + 8]
je 0x180007a5e
cmp qword [rbx + 0x10], 1
jne 0x180007a62
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18000baa0
add rsp, 0x80
pop rbx
ret
xor al, al
jmp 0x180007a48
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.180007ad0
nop
mov r8, rax
lea rdx, str.AcceptEncoding_does_not_accept_any_other_values_if_disabled_is_present._You_set_the_following_encodings:
lea rcx, [rsp + 0x58]
call fcn.180004b10
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.180007920
lea rdx, [0x1800110b8]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, str.invalid_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
Function at 0x140001330
Capabilities:
Delete file
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
lea rax, [r11 + 0x18]
mov qword [r11 + 0x20], rax
mov rcx, qword [rdx]
sub rcx, 0x18
call fcn.14000d260
add rax, 0x18
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x80]
call fcn.140003ed0
test al, al
jne 0x1400013f7
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400015a5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rbp, str.Failure_:_File_does_not_exist
mov rdx, rbp
mov rcx, rdi
call fcn.14000ce70
mov rbx, 0xffffffffffffffff
test al, al
jne 0x1400013ea
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rbp + rax*2], 0
jne 0x1400013d0
mov r8d, eax
mov rdx, rbp
mov rcx, rdi
call fcn.14000d350
nop
mov dword [rsp + 0x20], 1
jmp 0x140001574
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0x10
jne 0x140001477
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400015b0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rbp, str.Failure_:_File_specified_is_not_correct__DIR_
mov rdx, rbp
mov rcx, rdi
call fcn.14000ce70
mov rbx, 0xffffffffffffffff
test al, al
jne 0x14000146a
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rbp + rax*2], 0
jne 0x140001450
mov r8d, eax
mov rdx, rbp
mov rcx, rdi
call fcn.14000d350
nop
mov dword [rsp + 0x20], 1
jmp 0x140001574
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsi]
sub rcx, 0x18
call fcn.14000d260
add rax, 0x18
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x88]
call fcn.140003ed0
test al, al
jne 0x140001518
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400015bb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rbp, str.Success_:_File_deleted
mov rdx, rbp
mov rcx, rdi
call fcn.14000ce70
mov rbx, 0xffffffffffffffff
test al, al
jne 0x14000150e
mov rax, rbx
inc rax
cmp word [rbp + rax*2], 0
jne 0x1400014f4
mov r8d, eax
mov rdx, rbp
mov rcx, rdi
call fcn.14000d350
nop
mov dword [rsp + 0x20], 1
jmp 0x140001574
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14000159a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rbp, str.Failure_:_During_File_Deletion
mov rdx, rbp
mov rcx, rdi
call fcn.14000ce70
mov rbx, 0xffffffffffffffff
test al, al
jne 0x14000156c
mov rax, rbx
inc rax
cmp word [rbp + rax*2], 0
jne 0x140001552
mov r8d, eax
mov rdx, rbp
mov rcx, rdi
call fcn.14000d350
nop
mov dword [rsp + 0x20], 1
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14000158e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, rdi
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000df80
int3
mov ecx, 0x80004005
call fcn.14000df80
int3
mov ecx, 0x80004005
call fcn.14000df80
int3
mov ecx, 0x80004005
call fcn.14000df80
int3
Function at 0x1400015d0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
sub rsp, 0x48
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x20], 0
mov rcx, qword [rdx]
mov rdi, 0xffffffffffffffff
cmp dword [rcx - 0x10], 0
jl 0x14000166d
lea rdx, str._username_
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14000166d
sub rax, qword [r14]
sar rax, 1
cmp eax, edi
je 0x14000166d
lea rcx, [rsp + 0x80]
call fcn.140063f10
nop
mov r8, qword [rsp + 0x80]
lea rdx, str._username_
mov rcx, r14
call fcn.14000c1a0
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000166d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov rcx, qword [r14]
sub rcx, 0x18
call fcn.14000d260
add rax, 0x18
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x88]
call fcn.140003ed0
test al, al
jne 0x140001706
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140001804
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rbx, str.Failure_:_Folder_does_not_exist
mov rdx, rbx
mov rcx, rsi
call fcn.14000ce70
test al, al
jne 0x1400016f9
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400016e0
mov r8d, eax
mov rdx, rbx
mov rcx, rsi
call fcn.14000d350
nop
mov dword [rsp + 0x20], 1
jmp 0x1400017d2
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0x10
je 0x140001776
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x14000180f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rbx, str.Failure_:_Folder_specified_is_not_correct__Folder_
mov rdx, rbx
mov rcx, rsi
call fcn.14000ce70
test al, al
jne 0x14000176c
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140001753
mov r8d, eax
mov rdx, rbx
mov rcx, rsi
call fcn.14000d350
nop
mov dword [rsp + 0x20], 1
jmp 0x1400017d2
mov rcx, qword [r14]
call fcn.140003c10
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400017f9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rbx, str.Success_:_Folder_deleted
mov rdx, rbx
mov rcx, rsi
call fcn.14000ce70
test al, al
jne 0x1400017ca
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400017b1
mov r8d, eax
mov rdx, rbx
mov rcx, rsi
call fcn.14000d350
nop
mov dword [rsp + 0x20], 1
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400017ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, rsi
add rsp, 0x48
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000df80
int3
mov ecx, 0x80004005
call fcn.14000df80
int3
mov ecx, 0x80004005
call fcn.14000df80
int3
Function at 0x140003ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rcx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
cmp ebx, 0xffffffff
jne 0x140003f2e
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140003f21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140003f4d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret