joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100008af0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov ebx, 0x80004005
mov esi, 1
xor r12d, r12d
test esi, esi
je 0x100008ba6
lea rcx, [0x100030168]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov eax, dword [0x1000300c8]
test eax, eax
jne 0x100008b5a
lea r12d, [rax + 1]
mov dword [0x1000300c8], r12d
mov dword [0x1000300cc], r12d
mov rcx, qword [0x10002ea60]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor esi, esi
jmp 0x100008b17
cmp dword [0x1000300cc], 0
je 0x100008b8b
lea rcx, [0x100030168]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or edx, 0xffffffff
mov rcx, qword [0x10002ea60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100008b17
mov eax, ebx
jmp 0x100008ca3
xor esi, esi
inc eax
mov dword [0x1000300c8], eax
xor ebx, ebx
jmp 0x100008b17
lea rcx, [0x100030168]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r12d, r12d
je 0x100008ca1
lea rcx, [0x10002e9b0]
call fcn.100009f08
mov ebx, eax
test eax, eax
js 0x100008c5f
mov rax, qword [0x10002e9f0]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x100008be6
mov rcx, qword [rcx + 8]
and qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x42
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
js 0x100008c59
mov rax, qword [0x10002ea00]
add rax, 0x108
cmp qword [rax], 0
jne 0x100008c53
mov qword [rsp + 0x20], rax
lea r9, [0x100001a68]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x100001a58]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
jmp 0x100008c59
jmp 0x100008c5f
lea rcx, [0x100030168]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
test ebx, ebx
jns 0x100008c77
dec dword [0x1000300c8]
and dword [0x1000300cc], 0
mov rcx, qword [0x10002ea60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [0x100030168]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x100008ca1
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
Function at 0x10000ec88
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
mov rcx, qword [rcx]
mov qword [rax - 0x20], r9
mov rdi, r9
mov qword [rax - 0x28], rdx
mov rbx, rdx
lea r9, [rax - 0x18]
lea rdx, [0x100002460]
xor esi, esi
xor r8d, r8d
mov dword [rax - 0x18], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x30]
mov r11d, eax
cmp ecx, esi
jbe 0x10000ecfe
cmp ecx, 2
jbe 0x10000ed13
cmp ecx, 7
jne 0x10000ecfe
test byte [rdi], 1
jne 0x10000ecfe
mov eax, dword [rdi]
and eax, 0xfffffffe
cmp eax, 4
jb 0x10000ecfe
cmp rbx, rsi
je 0x10000ed29
mov eax, dword [rdi]
shr rax, 1
cmp word [rbx + rax*2 - 2], si
jne 0x10000ecfe
cmp word [rbx + rax*2 - 4], si
je 0x10000ed29
mov eax, 0xd
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
test byte [rdi], 1
jne 0x10000ecfe
cmp rbx, rsi
je 0x10000ed29
mov eax, dword [rdi]
shr rax, 1
cmp word [rbx + rax*2 - 2], si
jne 0x10000ecfe
mov eax, r11d
jmp 0x10000ed03
Function at 0x10000ed34
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rsi
mov r15d, ecx
xor esi, esi
and qword [r11 - 0x40], rsi
and qword [r11 - 0x38], rsi
xor edi, edi
mov qword [rsp + 0xa0], rdi
and qword [r11 + 0x10], rdi
lea rax, [r11 + 0x10]
mov qword [r11 - 0x68], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x100002488]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10000ef6f
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x40], rsi
and qword [rsp + 0xa8], rdi
and qword [rsp + 0x30], rdi
and dword [rsp + 0x98], edi
lea r9, [rsp + 0x98]
lea r8, [0x100002460]
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.10000ec88
test eax, eax
jne 0x10000ef6f
mov ecx, dword [rsp + 0x98]
add rcx, rcx
lea r12d, [rdi + 2]
mov rax, r12
mul rcx
lea rcx, [rdi - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.10001df34
mov r13, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x10000ef60
lea r9, [rsp + 0x98]
lea r8, [0x100002460]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.10000ec88
test eax, eax
jne 0x10000ef4f
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r14d, eax
test eax, eax
je 0x10000ef4f
mov rax, r12
mul r14
lea rcx, [rdi - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.10001df34
mov r12, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x10000ef4f
mov r8d, r14d
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r14d, eax
test eax, eax
je 0x10000ef41
test r15d, r15d
je 0x10000eef2
lea rcx, [0x100002440]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r15d, [rax + r14 + 1]
lea eax, [rdi + 2]
mul r15
lea rcx, [rdi - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.10001df34
mov rdi, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x10000ef41
mov rdx, r14
mov r8, r12
mov rcx, rax
call fcn.1000088c8
lea r8, [0x100002440]
mov rdx, r15
mov rcx, rdi
call fcn.100008820
jmp 0x10000ef41
add r14d, 2
mov eax, 2
mul r14
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.10001df34
mov rdi, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x10000ef41
mov r8, r12
mov rdx, r14
mov rcx, rax
call fcn.1000088c8
lea r8, [0x1000017a0]
mov rdx, r14
mov rcx, rdi
call fcn.100008820
mov rcx, r12
call sub.msvcrt.dll_free
and qword [rsp + 0x30], 0
mov rcx, r13
call sub.msvcrt.dll_free
and qword [rsp + 0xa8], 0
jmp 0x10000ef6f
test rsi, rsi
je 0x10000ef7d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rsi, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x10000f248
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push r12
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov edi, r9d
mov rbp, r8
xor r12d, r12d
mov rsi, r12
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x38], r12
lea rax, [r11 - 0x38]
mov qword [r11 - 0x48], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [0x1000023e0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r12d
jne 0x10000f2bf
mov ebx, r12d
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x40], rsi
cmp ebx, r12d
je 0x10000f2f3
cmp ebx, 5
je 0x10000f2ee
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x90]
lea rcx, [0x1000023e0]
call fcn.10000f060
cmp eax, r12d
cmovge ebx, r12d
mov rsi, qword [rsp + 0x40]
cmp ebx, r12d
jne 0x10000f317
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbp
mov r9d, 3
xor r8d, r8d
lea rdx, [0x1000023b8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
movzx edi, bx
or edi, 0x80070000
cmp ebx, r12d
cmovle edi, ebx
cmp rsi, r12
je 0x10000f334
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x10000f358
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
push rdi
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rdi, rdx
xor ebx, ebx
mov qword [r11 - 0x28], rbx
and qword [r11 - 0x20], rbx
and qword [r11 - 0x18], rbx
and qword [r11 - 0x38], rbx
lea rax, [r11 - 0x38]
mov qword [r11 - 0x48], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [0x1000023e0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10000f3b6
mov rbx, qword [rsp + 0x30]
jmp 0x10000f3d3
cmp eax, 5
je 0x10000f3d3
lea r8, [rsp + 0x40]
xor edx, edx
lea rcx, [0x1000023e0]
call fcn.10000f060
mov rbx, qword [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test rbx, rbx
je 0x10000f416
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x10000f42c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, r8
mov rsi, rdx
and qword [r8], 0
and qword [rax - 0x18], 0
lea r8, [rax - 0x18]
mov rdx, rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x10000f50b
and dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x10000f500
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x10000f500
mov rcx, rax
call fcn.10001df34
mov qword [rdi], rax
test rax, rax
je 0x10000f4f5
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x10000f4fa
mov rcx, qword [rdi]
call sub.msvcrt.dll_free
and qword [rdi], 0
jmp 0x10000f4fa
mov ebx, 0xe
jmp 0x10000f500
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x10000f530
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x40
xor edi, edi
mov rbx, r8
mov rsi, rdx
lea eax, [rdi + 0x57]
test rdx, rdx
je 0x10000f5d9
test rbx, rbx
je 0x10000f5d4
and dword [r8], edi
and qword [r11 - 0x18], rdi
lea rax, [r11 - 0x18]
lea rdx, [0x1000023e0]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10000f5d9
mov rdi, qword [rsp + 0x30]
test eax, eax
jne 0x10000f5d9
and dword [rsp + 0x50], eax
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x50], 4
mov ecx, 0xd
cmovne eax, ecx
jmp 0x10000f5d9
mov eax, 0x80004003
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test rdi, rdi
je 0x10000f5f5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x10000f610
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r8, [rcx + 8]
lea rdx, [0x100001910]
lea rcx, [0x1000022f0]
call 0x10000f610
lea r8, [rbx + 0xc]
lea rdx, [0x100001930]
lea rcx, [0x1000022f0]
call 0x10000f610
lea r8, [rbx + 0x10]
lea rdx, [0x100001948]
lea rcx, [0x1000022f0]
call 0x10000f610
lea r8, [rbx + 0x14]
lea rdx, [0x100001968]
lea rcx, [0x1000022f0]
add rsp, 0x20
pop rbx
jmp 0x10000f610
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [0x1000301e8]
mov rbx, r8
mov rdi, rdx
test al, 1
jne 0x10000f657
and qword [0x1000301d0], 0
and qword [0x1000301d8], 0
and qword [0x1000301e0], 0
or eax, 1
lea rcx, [0x1000228fc]
mov dword [0x1000301e8], eax
call fcn.10001e464
test rbx, rbx
je 0x10000f708
and dword [rbx], 0
mov rcx, qword [0x1000301d0]
test rcx, rcx
jne 0x10000f6c8
and qword [rsp + 0x50], rcx
lea rax, [rsp + 0x50]
lea rdx, [0x1000022f0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [0x1000301d0]
mov r11d, eax
test eax, eax
jne 0x10000f6c3
test rcx, rcx
je 0x10000f6b7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, eax
mov rcx, qword [rsp + 0x50]
mov qword [0x1000301d0], rcx
test r11d, r11d
jne 0x10000f70e
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x50], 4
mov r11d, eax
mov eax, 0xd
cmovne r11d, eax
jmp 0x10000f70e
mov r11d, 0x80004003
mov rbx, qword [rsp + 0x40]
movzx eax, r11w
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
add rsp, 0x30
pop rdi
ret
Function at 0x100010c68
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x10002e120]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor esi, esi
mov rdi, rcx
mov ebx, 1
cmp qword [rcx + 0x50], rsi
jne 0x100010df4
lea rcx, [r11 - 0x226]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x230], si
call sub.msvcrt.dll_memset
mov ebp, 0x105
lea rcx, [rsp + 0x230]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r11d, eax
cmp eax, ebp
jbe 0x100010ce7
mov ebx, 0x8000ffff
jmp 0x100010df4
lea r9, [rsp + 0x230]
lea rax, [rsp + 0x20]
mov rdx, rbp
lea rcx, [rsp + 0x20]
mov r8d, esi
sub r9, rax
lea rax, [rdx + 0x7ffffef9]
cmp rax, rsi
je 0x100010d24
movzx eax, word [r9 + rcx]
cmp ax, si
je 0x100010d24
mov word [rcx], ax
add rcx, 2
sub rdx, rbx
jne 0x100010d02
cmp rdx, rsi
jne 0x100010d33
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, esi
mov word [rcx], si
mov ebx, r8d
jl 0x100010df4
cmp word [rsp + r11*2 + 0x20], 0x5c
je 0x100010d61
lea r8, [0x1000017a0]
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.100008820
mov ebx, eax
cmp ebx, esi
jl 0x100010df4
lea r8, [0x1000027a8]
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.100008820
cmp eax, esi
mov ebx, eax
jl 0x100010df4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rdi + 0x50], rax
cmp rax, rsi
jne 0x100010d9e
mov ebx, 0x80070485
jmp 0x100010df4
lea rdx, [0x1000027c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x50]
lea rdx, [0x1000027d0]
mov qword [rdi + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x50]
lea rdx, [0x1000027e8]
mov qword [rdi + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x68], rax
cmp qword [rdi + 0x58], rsi
je 0x100010def
cmp qword [rdi + 0x60], rsi
je 0x100010def
mov ebx, esi
cmp rax, rsi
jne 0x100010df4
mov ebx, 0x8007007f
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.10001e360
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1000118a0
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x40]
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r12
mov rax, qword [0x10002e120]
xor rax, rbp
mov qword [rbp + 0x10], rax
mov rbx, rdx
mov r12, rcx
cmp qword [rcx + 0x78], 0
je 0x1000119b9
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x1000119b9
test rdx, rdx
je 0x1000119b9
and dword [rbp], 0
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [rax + rax + 2]
movsxd rcx, edx
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x100011928
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.10001ed40
sub rsp, rax
lea rsi, [rsp + 0x40]
test rsi, rsi
je 0x100011971
mov byte [rsi], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rsi
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rdx, rdx
and rdx, rsi
jmp 0x100011973
xor edx, edx
and qword [rsp + 0x20], 0
lea r9, [rbp]
mov r8d, edi
mov rcx, qword [r12 + 0x78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000119a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x1000119b2
xor ecx, ecx
mov eax, 0x80004005
cmp edi, dword [rbp]
cmovne ecx, eax
jmp 0x1000119be
mov ecx, 0x80070057
mov eax, ecx
mov rcx, qword [rbp + 0x10]
xor rcx, rbp
call fcn.10001e360
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
mov r12, qword [rbp + 0x48]
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x1000119e8
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx + 0x78], 0
je 0x100011a77
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x100011a77
test rdx, rdx
je 0x100011a77
and dword [rsp + 0x50], 0
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
add ebx, ebx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100011a61
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x100011a6f
xor ecx, ecx
mov eax, 0x80004005
cmp ebx, dword [rsp + 0x50]
cmovne ecx, eax
jmp 0x100011a7c
mov ecx, 0x80070057
mov eax, ecx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x100011a94
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov r13, rdx
mov r14, rcx
mov ebx, 0x8007000e
and qword [rsp + 0xa0], 0
test rdx, rdx
je 0x100011c3f
mov r12d, 1
mov ecx, r12d
call fcn.10000ed34
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x100011c44
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov dword [rsp + 0x98], eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax + rdi + 1]
mov qword [rsp + 0xa8], rcx
lea eax, [r12 + 1]
mul rcx
mov r15, 0xffffffffffffffff
cmovo rax, r15
mov rcx, rax
call fcn.10001df34
mov rdi, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x100011b74
mov edx, dword [rsp + 0x98]
inc edx
mov r8, rsi
mov rcx, rax
call fcn.1000088c8
mov ebx, eax
test eax, eax
js 0x100011b74
mov r8, r13
mov rdx, qword [rsp + 0xa8]
mov rcx, rdi
call fcn.100008820
mov ebx, eax
test eax, eax
cmovns ebx, r12d
jmp 0x100011b9c
test ebx, ebx
js 0x100011c28
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100011bd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100011bd6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100011bd9
mov ebx, r12d
test ebx, ebx
js 0x100011c28
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, r12d
mov edx, 0x40000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 0x78], rax
cmp rax, r15
jne 0x100011c26
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100011c28
xor ebx, ebx
test rdi, rdi
je 0x100011c35
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x100011c44
mov ebx, 0x80070057
mov eax, ebx
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x100011c5c
Capabilities:
Delete file

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r12, rdx
mov rdi, rcx
mov ebx, 0x8007000e
and qword [rsp + 0x78], 0
mov rcx, qword [rcx + 0x78]
test rcx, rcx
je 0x100011c9a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rdi + 0x78], 0
test r12, r12
je 0x100011d84
mov r15d, 1
mov ecx, r15d
call fcn.10000ed34
mov rsi, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x100011d89
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r13d, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r14d, [rax + r13 + 1]
lea eax, [r15 + 1]
mul r14
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.10001df34
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x100011d31
lea edx, [r13 + 1]
mov r8, rsi
mov rcx, rax
call fcn.1000088c8
mov ebx, eax
test eax, eax
js 0x100011d31
mov r8, r12
mov rdx, r14
mov rcx, rdi
call fcn.100008820
mov ebx, eax
test eax, eax
cmovns ebx, r15d
jmp 0x100011d44
test ebx, ebx
js 0x100011d6d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100011d6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100011d6d
xor ebx, ebx
test rdi, rdi
je 0x100011d7a
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x100011d89
mov ebx, 0x80070057
mov eax, ebx
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x100011da4
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov ebx, 0x8007000e
and qword [rsp + 0x88], 0
and qword [rsp + 0x98], 0
mov rcx, qword [rcx + 0x78]
test rcx, rcx
je 0x100011df5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rdi + 0x78], 0
test r15, r15
je 0x100011fc5
test r14, r14
je 0x100011fc5
mov r13d, 1
mov ecx, r13d
call fcn.10000ed34
mov r12, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x100011fca
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov dword [rsp + 0x80], eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax + rdi + 1]
mov qword [rsp + 0x28], rcx
lea eax, [r13 + 1]
mul rcx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.10001df34
mov rsi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x100011ea6
mov edx, dword [rsp + 0x80]
inc edx
mov r8, r12
mov rcx, rax
call fcn.1000088c8
mov ebx, eax
test eax, eax
js 0x100011ea6
mov r8, r15
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.100008820
mov ebx, eax
test eax, eax
cmovns ebx, r13d
jmp 0x100011ece
test ebx, ebx
js 0x100011fae
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r15d, [rax + rbx + 1]
mov eax, 2
mul r15
cmovo rax, rdi
mov rcx, rax
call fcn.10001df34
mov rdi, rax
mov qword [rsp + 0x98], rax
test rax, rax
je 0x100011f40
lea edx, [rbx + 1]
mov r8, r12
mov rcx, rax
call fcn.1000088c8
mov ebx, eax
test eax, eax
js 0x100011f45
mov r8, r14
mov rdx, r15
mov rcx, rdi
call fcn.100008820
mov ebx, eax
test eax, eax
js 0x100011f45
mov ebx, r13d
jmp 0x100011f45
mov ebx, 0x8007000e
jmp 0x100011f69
test ebx, ebx
js 0x100011fa1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, r13d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x100011f9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100011fa1
xor ebx, ebx
test rdi, rdi
je 0x100011fae
mov rcx, rdi
call sub.msvcrt.dll_free
test rsi, rsi
je 0x100011fbb
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x100011fca
mov ebx, 0x80070057
mov eax, ebx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret