joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030a90
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x2c], 0
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x30], 0
mov r8d, dword [rsp + 0x30]
mov edx, dword [rsp + 0x68]
lea rcx, [rsp + 0x2c]
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_Size]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140030aec
xor eax, eax
jmp 0x140030ba9
mov eax, dword [rsp + 0x2c]
add eax, 1
mov dword [rsp + 0x2c], eax
mov ecx, dword [rsp + 0x2c]
mov eax, 2
mul rcx
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.140006748
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140030ba4
mov r8d, dword [rsp + 0x2c]
shl r8, 1
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.14001c3c0
mov dword [rsp + 0x30], 0
mov r9d, dword [rsp + 0x30]
mov r8d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x20]
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.SETUPAPI.dll_CM_Get_Device_IDW]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x140030b87
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x14006ed9c]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x140030ba4
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.140006750
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x20]
add rsp, 0x58
ret

Function at 0x140031090
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x50], 0
lea rcx, [rsp + 0x48]
call fcn.140001290
nop
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.PrintQueue
lea rdx, [0x140070fc0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
mov dword [rsp + 0x50], eax
mov edx, dword [rsp + 0x54]
lea rcx, [rsp + 0x48]
call fcn.140001320
mov r11, rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r11
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [0x140071038]
lea rdx, str.SOFTWAREWOW6432NodeEpsonNetEpsonNet_Easy_Network_Setup
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
mov dword [rsp + 0x50], eax
mov edx, 0xffffffff
lea rcx, [rsp + 0x48]
call fcn.1400058e0
cmp dword [rsp + 0x50], 0
jne 0x14003119f
lea rcx, [rsp + 0x48]
call fcn.140001310
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call fcn.140030fc0
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x48]
call fcn.1400012c0
mov eax, dword [rsp + 0x58]
add rsp, 0x78
ret
Function at 0x140034510
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1b0
mov qword [rsp + 0x1a0], 0xfffffffffffffffe
mov rax, qword [0x14008c080]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
lea rax, str.GetOemInfPathInWindowsInf
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x28]
lea rcx, [0x140072128]
call fcn.14002d6b0
mov rdx, qword [rsp + 0x1c0]
lea rcx, str.DriverName
call fcn.14002d580
mov rcx, qword [rsp + 0x1c8]
call fcn.140001310
mov rdx, rax
lea rcx, [0x140072168]
call fcn.14002d580
mov dword [rsp + 0x70], 0
lea rdi, [rsp + 0x74]
xor eax, eax
mov ecx, 0x118
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0
lea rdi, [rsp + 0x34]
xor eax, eax
mov ecx, 0x2c
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0x11c
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rcx, [rsp + 0x30]
call fcn.140060750
cmp dword [rsp + 0x74], 5
jbe 0x1400345ff
lea r8, str.Operation_is_not_required__
mov rdx, qword [rsp + 0x28]
lea rcx, [0x1400721b8]
call fcn.14002d610
mov eax, 0x70d
jmp 0x1400346bb
mov dword [rsp + 0x20], 0
mov rdx, qword [rsp + 0x1c8]
lea rcx, [rsp + 0x190]
call fcn.140001ec0
nop
lea rcx, [rsp + 0x190]
call fcn.140033990
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140034686
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x1c0]
call fcn.140034090
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140034686
lea rcx, [rsp + 0x190]
call fcn.140001310
mov rdx, rax
lea rcx, str.WindowsInf
call fcn.14002d580
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x1c8]
call fcn.140002e80
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
lea rcx, str.CFaxDriverInstall
call fcn.14002e080
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x198], eax
lea rcx, [rsp + 0x190]
call fcn.1400012c0
mov eax, dword [rsp + 0x198]
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14001b9f0
add rsp, 0x1b0
pop rdi
ret
Function at 0x140035420
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov rax, qword [0x14008c080]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov dword [rsp + 0x15c], 0
cmp dword [rsp + 0x2c0], 0
ja 0x14003547f
cmp dword [rsp + 0x2b8], 0x8000
ja 0x14003547f
mov eax, dword [rsp + 0x2b8]
mov dword [rsp + 0x274], eax
jmp 0x14003548a
mov dword [rsp + 0x274], 0x8000
mov eax, dword [rsp + 0x274]
mov dword [rsp + 0x148], eax
mov edx, dword [rsp + 0x148]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x150], rax
cmp qword [rsp + 0x150], 0
jne 0x1400354da
lea rax, [rsp + 0x170]
mov qword [rsp + 0x168], rax
mov dword [rsp + 0x148], 0x100
jmp 0x1400354ea
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x168], rax
mov edx, dword [rsp + 0x148]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140035523
lea rax, [rsp + 0x40]
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x148], 0x100
jmp 0x140035530
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x158]
mov r8d, dword [rsp + 0x148]
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x160], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x164]
mov r8d, dword [rsp + 0x148]
mov rdx, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x270], eax
cmp dword [rsp + 0x160], 0
je 0x1400355b0
cmp dword [rsp + 0x158], 0
jne 0x1400355f4
cmp dword [rsp + 0x270], 0
je 0x1400355d1
cmp dword [rsp + 0x164], 0
je 0x1400355d1
mov dword [rsp + 0x278], 1
jmp 0x1400355dc
mov dword [rsp + 0x278], 0
mov eax, dword [rsp + 0x278]
mov dword [rsp + 0x15c], eax
jmp 0x1400356d0
cmp dword [rsp + 0x270], 0
je 0x14003560e
mov eax, dword [rsp + 0x164]
cmp dword [rsp + 0x158], eax
je 0x14003561e
mov dword [rsp + 0x15c], 1
jmp 0x1400356aa
mov r8d, dword [rsp + 0x158]
mov rdx, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x168]
call fcn.14001ccc0
mov dword [rsp + 0x15c], eax
mov eax, dword [rsp + 0x2b8]
cmp dword [rsp + 0x158], eax
jbe 0x140035693
cmp dword [rsp + 0x2c0], 0
jbe 0x140035686
mov eax, dword [rsp + 0x2c0]
sub eax, 1
mov dword [rsp + 0x2c0], eax
mov ecx, dword [rsp + 0x158]
mov eax, dword [rsp + 0x2b8]
sub eax, ecx
mov dword [rsp + 0x2b8], eax
jmp 0x140035691
mov dword [rsp + 0x2b8], 0
jmp 0x1400356aa
mov ecx, dword [rsp + 0x158]
mov eax, dword [rsp + 0x2b8]
sub eax, ecx
mov dword [rsp + 0x2b8], eax
cmp dword [rsp + 0x15c], 0
jne 0x1400356d0
cmp dword [rsp + 0x2c0], 0
ja 0x140035530
cmp dword [rsp + 0x2b8], 0
ja 0x140035530
cmp qword [rsp + 0x30], 0
je 0x1400356e3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp qword [rsp + 0x150], 0
je 0x1400356fc
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [rsp + 0x15c]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14001b9f0
add rsp, 0x298
ret
Function at 0x140035a00
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x14008c080]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov dword [rsp + 0x38], 2
mov rax, qword [rsp + 0x2d0]
mov rax, qword [rax]
lea rdx, str.prn.inf
mov rcx, qword [rsp + 0x2d0]
call qword [rax + 0x30]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140035b7e
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x140035b6c
mov dword [rsp + 0x2a0], 0
mov eax, dword [rsp + 0x50]
and eax, 0x10
test eax, eax
jne 0x140035b2d
mov rax, qword [rsp + 0x2d0]
mov rax, qword [rax]
lea rdx, [rsp + 0x7c]
mov rcx, qword [rsp + 0x2d0]
call qword [rax + 0x30]
mov qword [rsp + 0x2a8], rax
cmp qword [rsp + 0x2a8], 0
je 0x140035b2d
mov r10, qword [rsp + 0x2d0]
mov r10, qword [r10]
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x2e8]
mov r8, qword [rsp + 0x2a8]
mov rdx, qword [rsp + 0x2d8]
mov rcx, qword [rsp + 0x2d0]
call qword [r10 + 0x70]
mov dword [rsp + 0x2a0], eax
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2d0]
call fcn.1400357e0
cmp dword [rsp + 0x2a0], 0
jne 0x140035b4f
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140035a8f
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x2a0], 0
je 0x140035b6c
mov dword [rsp + 0x38], 0x50
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x2d0]
call fcn.1400357e0
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14001b9f0
add rsp, 0x2c8
ret
Function at 0x140035ba0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x8e8
mov rax, qword [0x14008c080]
xor rax, rsp
mov qword [rsp + 0x8d8], rax
mov dword [rsp + 0x38], 2
mov rax, qword [rsp + 0x8f0]
mov rax, qword [rax]
lea rdx, [0x140072c00]
mov rcx, qword [rsp + 0x8f0]
call qword [rax + 0x30]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140035e0a
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x140035df8
mov dword [rsp + 0x2a4], 0
mov dword [rsp + 0x2a0], 0
mov eax, dword [rsp + 0x50]
and eax, 0x10
test eax, eax
jne 0x140035da5
mov rax, qword [rsp + 0x8f0]
mov rax, qword [rax]
lea rdx, [rsp + 0x7c]
mov rcx, qword [rsp + 0x8f0]
call qword [rax + 0x30]
mov qword [rsp + 0x2a8], rax
cmp qword [rsp + 0x2a8], 0
je 0x140035da5
mov r10, qword [rsp + 0x8f0]
mov r10, qword [r10]
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x910]
mov r8, qword [rsp + 0x2a8]
mov rdx, qword [rsp + 0x8f8]
mov rcx, qword [rsp + 0x8f0]
call qword [r10 + 0x78]
mov dword [rsp + 0x2a4], eax
cmp dword [rsp + 0x2a4], 0
je 0x140035d90
mov eax, dword [rsp + 0x918]
and eax, 4
test eax, eax
je 0x140035d24
mov rcx, qword [rsp + 0x900]
mov rax, qword [rsp + 0x8c8]
cmp qword [rcx + 0x618], rax
je 0x140035d09
mov dword [rsp + 0x8d0], 1
jmp 0x140035d14
mov dword [rsp + 0x8d0], 0
mov eax, dword [rsp + 0x8d0]
mov dword [rsp + 0x2a4], eax
jmp 0x140035d7f
mov rax, qword [rsp + 0x8f0]
mov rax, qword [rax]
mov r9d, dword [rsp + 0x918]
mov r8, qword [rsp + 0x2a8]
mov rdx, qword [rsp + 0x908]
mov rcx, qword [rsp + 0x8f0]
call qword [rax + 0x80]
test eax, eax
je 0x140035d66
mov dword [rsp + 0x8d4], 1
jmp 0x140035d71
mov dword [rsp + 0x8d4], 0
mov eax, dword [rsp + 0x8d4]
mov dword [rsp + 0x2a4], eax
mov eax, dword [rsp + 0x2a0]
add eax, 1
mov dword [rsp + 0x2a0], eax
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x8f0]
call fcn.1400357e0
cmp dword [rsp + 0x2a4], 0
jne 0x140035dc7
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140035c3a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x2a4], 0
je 0x140035de6
mov dword [rsp + 0x38], 0x50
jmp 0x140035df8
cmp dword [rsp + 0x2a0], 0
jbe 0x140035df8
mov dword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x8f0]
call fcn.1400357e0
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x8d8]
xor rcx, rsp
call fcn.14001b9f0
add rsp, 0x8e8
ret
Function at 0x1400363b0
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea rcx, [0x140072bb8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400363ec
mov edx, 0x7e
mov rcx, qword [rsp + 0x50]
call fcn.140005cd0
jmp 0x1400364d0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
and eax, 0xfffffffc
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
or eax, 0x80
mov dword [rsp + 0x24], eax
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [0x140072bd8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140036472
mov rcx, qword [rsp + 0x58]
call fcn.140035730
xor r8d, r8d
mov edx, 1
mov rcx, rax
call qword [rsp + 0x28]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.140005cd0
jmp 0x1400364c5
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x68]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x60]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.140005cd0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x48
ret
Function at 0x140036b00
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x8e8
mov rax, qword [0x14008c080]
xor rax, rsp
mov qword [rsp + 0x8d8], rax
mov dword [rsp + 0x38], 2
mov rax, qword [rsp + 0x8f0]
mov rax, qword [rax]
lea rdx, str.oem.inf
mov rcx, qword [rsp + 0x8f0]
call qword [rax + 0x30]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140036cdf
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x140036ccd
mov dword [rsp + 0x2a0], 0
mov eax, dword [rsp + 0x50]
and eax, 0x10
test eax, eax
jne 0x140036ca0
mov rax, qword [rsp + 0x8f0]
mov rax, qword [rax]
lea rdx, [rsp + 0x7c]
mov rcx, qword [rsp + 0x8f0]
call qword [rax + 0x30]
mov qword [rsp + 0x2a8], rax
cmp qword [rsp + 0x2a8], 0
je 0x140036ca0
mov r10, qword [rsp + 0x8f0]
mov r10, qword [r10]
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x908]
mov r8, qword [rsp + 0x2a8]
mov rdx, qword [rsp + 0x8f8]
mov rcx, qword [rsp + 0x8f0]
call qword [r10 + 0x70]
mov dword [rsp + 0x2a0], eax
cmp dword [rsp + 0x2a0], 0
je 0x140036c8b
mov edx, 0x7fffffff
lea rcx, [rsp + 0x2c0]
call fcn.140036aa0
mov qword [rsp + 0x8d0], rax
mov rdx, qword [rsp + 0x900]
add rdx, 0x10
lea rcx, [rsp + 0x2c0]
call fcn.14001c5e0
test eax, eax
je 0x140036c8b
cmp qword [rsp + 0x910], 0
je 0x140036c83
mov r8d, 0x620
lea rdx, [rsp + 0x2b0]
mov rcx, qword [rsp + 0x910]
call fcn.14001c7a0
mov dword [rsp + 0x38], 0x50
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x8f0]
call fcn.1400357e0
cmp dword [rsp + 0x2a0], 0
jne 0x140036cc2
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140036b8f
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x8f0]
call fcn.1400357e0
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x8d8]
xor rcx, rsp
call fcn.14001b9f0
add rsp, 0x8e8
ret
Function at 0x140036fa0
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov edx, 0x7fffffff
mov rcx, qword [rsp + 0x68]
call fcn.140036aa0
add rax, 0x104
mov qword [rsp + 0x38], rax
mov eax, 2
mul qword [rsp + 0x38]
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.140006748
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140037012
mov edx, 8
mov rcx, qword [rsp + 0x60]
call fcn.140005cd0
xor eax, eax
jmp 0x140037157
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.140001c10
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x140037042
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
test eax, eax
je 0x140037050
jmp 0x140037032
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x28], rax
jae 0x14003709a
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x2e
je 0x14003709a
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5c
je 0x14003709a
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x2f
je 0x14003709a
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_CharPrevW]
mov qword [rsp + 0x20], rax
jmp 0x140037050
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x2e
jne 0x1400370c8
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_CharNextW]
lea r8, [0x140072bf0]
mov rdx, qword [rsp + 0x38]
mov rcx, rax
call fcn.140001c10
jmp 0x1400370f4
lea r8, [0x14006f514]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.140001d10
lea r8, [0x140072bf8]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.140001d10
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
and eax, 0xfffffffc
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
or eax, 0x80
mov dword [rsp + 0x34], eax
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, qword [rsp + 0x60]
call fcn.140005cd0
mov eax, dword [rsp + 0x30]
add rsp, 0x58
ret
Function at 0x14003f890
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14008c080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov r8d, 0x10
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x4c], 0
jbe 0x14003fa23
mov eax, dword [rsp + 0x4c]
cmp rax, 4
jb 0x14003f955
mov edx, 4
lea rcx, [0x140070074]
call fcn.14003f7b0
mov r8, rax
lea rdx, [0x14007010c]
lea rcx, [rsp + 0x38]
call fcn.14001ccc0
test eax, eax
jne 0x14003f955
mov edx, 4
lea rcx, [0x140070284]
call fcn.14003f7b0
mov r11, rax
mov rax, qword [rsp + 0x88]
mov dword [rax], r11d
mov dword [rsp + 0x48], 2
jmp 0x14003fa23
mov eax, dword [rsp + 0x4c]
cmp rax, 3
jb 0x14003f9b1
mov edx, 3
lea rcx, [0x140070314]
call fcn.14003f7b0
mov r8, rax
lea rdx, [0x14007036c]
lea rcx, [rsp + 0x38]
call fcn.14001ccc0
test eax, eax
jne 0x14003f9b1
mov edx, 3
lea rcx, [0x140070414]
call fcn.14003f7b0
mov r11, rax
mov rax, qword [rsp + 0x88]
mov dword [rax], r11d
mov dword [rsp + 0x48], 3
jmp 0x14003fa23
mov eax, dword [rsp + 0x4c]
cmp rax, 3
jb 0x14003fa0d
mov edx, 3
lea rcx, [0x140070454]
call fcn.14003f7b0
mov r8, rax
lea rdx, [0x14007047c]
lea rcx, [rsp + 0x38]
call fcn.14001ccc0
test eax, eax
jne 0x14003fa0d
mov edx, 3
lea rcx, [0x1400704e4]
call fcn.14003f7b0
mov r11, rax
mov rax, qword [rsp + 0x88]
mov dword [rax], r11d
mov dword [rsp + 0x48], 4
jmp 0x14003fa23
mov rax, qword [rsp + 0x88]
mov dword [rax], 0
mov dword [rsp + 0x48], 1
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001b9f0
add rsp, 0x68
ret
Function at 0x14003fff0
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x5c], eax
cmp qword [rsp + 0x48], 0xffffffffffffffff
je 0x140040247
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xa0]
call qword [rax + 0x160]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0
je 0x14004023c
mov qword [rsp + 0x70], 0
cmp dword [rsp + 0x6c], 2
jne 0x1400400f8
lea rax, [0x14003ec70]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x58]
shl eax, 1
mov dword [rsp + 0x54], eax
jmp 0x140040148
cmp dword [rsp + 0x6c], 3
jne 0x140040115
lea rax, [fcn.14003e980]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x54], eax
jmp 0x140040148
cmp dword [rsp + 0x6c], 4
jne 0x140040132
lea rax, [0x14003ff40]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x54], eax
jmp 0x140040148
lea rax, [0x14003ecb0]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x58]
shl eax, 1
mov dword [rsp + 0x54], eax
mov ecx, dword [rsp + 0x58]
mov eax, dword [rsp + 0x54]
lea rcx, [rcx + rax + 6]
call fcn.140006748
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x14004023c
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x68], eax
mov ecx, dword [rsp + 0x68]
mov eax, dword [rsp + 0x58]
sub eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x60]
add rdx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x68], eax
jne 0x140040222
mov eax, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x60]
add rdx, rax
mov rax, qword [rsp + 0xa0]
mov r9d, dword [rax + 0x10]
mov r8d, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x70]
mov dword [rsp + 0x68], eax
mov r8d, dword [rsp + 0x68]
mov r9d, dword [rsp + 0xb0]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xa0]
call fcn.14003d3c0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.140006750
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
add rsp, 0x98
ret