joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d2ba0
Capabilities:
Check if file exists
Get common file path
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r12, qword [0x14022c040]
mov r15, qword [rbp + 0x70]
mov rax, qword [r12]
mov qword [rbp - 8], rax
mov eax, 0x4000
mov r14d, edx
mov r13, r8
mov rdi, r9
call fcn.1401d92a0
xor r9d, r9d
mov r8d, 7
xor edx, edx
sub rsp, rax
mov qword [rsp + 0x30], 0
lea rsi, [rsp + 0x40]
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400d2d12
lea rax, [rbp - 0xc]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rax
mov edx, 0x900a8
mov rcx, rbx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x4000
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400d2ce8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi]
mov dword [r15], eax
cmp eax, 0xa0000003
je 0x1400d2cd0
cmp eax, 0xa000000c
jne 0x1400d2cc0
movzx eax, word [rsi + 8]
xor r8d, r8d
lea rcx, [rsi + rax + 0x14]
movzx eax, word [rsi + 0xa]
mov word [rcx + rax], r8w
call fcn.1400cfc50
mov r8d, 0x1000
mov rcx, r13
mov rdx, rax
call fcn.1400d2b10
mov dword [rdi], eax
sar eax, 0x1f
mov rdx, qword [rbp - 8]
sub rdx, qword [r12]
jne 0x1400d2d3c
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
test r14d, r14d
jne 0x1400d2d2e
mov dword [rdi], 0x1000
xor eax, eax
jmp 0x1400d2ca1
movzx eax, word [rsi + 8]
xor edx, edx
lea rcx, [rsi + rax + 0x10]
movzx eax, word [rsi + 0xa]
mov word [rcx + rax], dx
jmp 0x1400d2c86
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, edi
mov rsi, rax
call fcn.1400d0b80
mov rcx, rbx
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x1400d2ca1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, esi
mov rbx, rax
call fcn.1400d0b80
mov dword [rbx], eax
jmp 0x1400d2d0b
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x1400d2d0b
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400d2d50
Capabilities:
Check if file exists
Get common file path
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x238
mov rbp, qword [0x14022c040]
mov r9d, 0xffffffff
mov r8d, 0x104
mov rdi, qword [rbp]
mov qword [rsp + 0x228], rdi
lea rdi, [rsp + 0x20]
mov rbx, rcx
mov rdx, rcx
mov rcx, rdi
call fcn.1400d25c0
test eax, eax
js 0x1400d2e30
movsx eax, byte [rbx]
cmp eax, 0x5c
je 0x1400d2df8
cmp eax, 0x2f
je 0x1400d2df8
xor esi, esi
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wmktemp]
test rax, rax
je 0x1400d2e3e
mov rcx, rbx
movsxd rsi, esi
call sub.msvcrt.dll_strlen
lea rdx, [rdi + rsi*2]
mov rcx, rbx
lea r8, [rax + 1]
call fcn.1400d2b10
test eax, eax
js 0x1400d2e3e
mov rax, qword [rsp + 0x228]
sub rax, qword [rbp]
jne 0x1400d2e54
mov rax, rbx
add rsp, 0x238
pop rbx
pop rsi
pop rdi
pop rbp
ret
movsx eax, byte [rbx + 1]
cmp eax, 0x2f
je 0x1400d2da2
cmp eax, 0x5c
je 0x1400d2da2
movzx ecx, word [rsp + 0x20]
mov edx, 0x103
call sub.msvcrt.dll_iswctype
test eax, eax
je 0x1400d2da2
xor esi, esi
cmp word [rsp + 0x22], 0x3a
sete sil
add esi, esi
jmp 0x1400d2da4
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400d2e48
xor ebx, ebx
jmp 0x1400d2dd5
call rbx
xor ebx, ebx
mov dword [rax], 0x26
jmp 0x1400d2dd5
call fcn.1401d96b0
nop
nop word [rax + rax]
Function at 0x1400d2e60
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x460
mov rdi, qword [0x14022c040]
mov r12, qword [rdi]
mov qword [rsp + 0x458], r12
lea r12, [rsp + 0x40]
mov rbx, rcx
mov ebp, edx
mov ecx, 0x104
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [rax - 1]
cmp edx, 0x102
ja 0x1400d2fe0
mov dword [rsp + 0x28], 0x2000000
xor r9d, r9d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400d2f80
lea r14, [rsp + 0x250]
xor r9d, r9d
mov r8d, 0x104
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov rcx, rsi
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub r13d, 1
cmp r13d, 0x102
jbe 0x1400d2f3b
mov rdx, r14
mov r8d, 0x104
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea edx, [rax - 1]
cmp edx, 0x102
ja 0x1400d2fe0
mov rcx, r14
call fcn.1400cfc50
movsxd r8, ebp
mov rcx, rbx
mov rdx, rax
call fcn.1400d2b10
test eax, eax
js 0x1400d2ff1
mov rax, rbx
mov rdx, qword [rsp + 0x458]
sub rdx, qword [rdi]
jne 0x1400d302b
add rsp, 0x460
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d3018
movsxd r8, ebp
mov rdx, r12
mov rcx, rbx
call fcn.1400d2b10
test eax, eax
js 0x1400d2ff1
movzx edx, byte [rbx]
test dl, dl
je 0x1400d2f59
mov rax, rbx
nop word cs:[rax + rax]
nop dword [rax]
cmp dl, 0x5c
jne 0x1400d2fc8
mov byte [rax], 0x2f
movzx edx, byte [rax + 1]
add rax, 1
test dl, dl
jne 0x1400d2fc0
jmp 0x1400d2f59
mov ebx, 0x26
test eax, eax
je 0x1400d3000
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], ebx
xor eax, eax
jmp 0x1400d2f5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400d0b80
mov ebx, eax
jmp 0x1400d2fe9
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 2
xor eax, eax
jmp 0x1400d2f5c
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400d3640
Capabilities:
Get session user name

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x120
mov rbx, qword [0x14022c040]
mov rax, qword [rbx]
mov qword [rsp + 0x118], rax
xor eax, eax
mov eax, dword [0x140256190]
test eax, eax
je 0x1400d3690
mov rax, qword [0x140256188]
mov rdx, qword [rsp + 0x118]
sub rdx, qword [rbx]
jne 0x1400d3775
add rsp, 0x120
pop rbx
pop rsi
pop rdi
ret
lea rsi, [rsp + 0x50]
mov dword [rsp + 0x4c], 0x64
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400d3750
xor edx, edx
mov r9d, 0xffffffff
mov r8, rsi
mov ecx, 0xfde9
lea rdi, [0x140256120]
mov dword [rsp + 0x28], 0x64
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1400d3742
sub eax, 1
js 0x1400d3750
mov ecx, 0x18
call fcn.1400bd0a0
mov ecx, 3
mov qword [rax], rdi
mov rsi, rax
mov qword [0x140256188], rax
call fcn.1400d3500
mov qword [rsi + 8], rax
mov rax, qword [0x140256188]
cmp qword [rax + 8], 0
je 0x1400d3768
mov qword [rax + 0x10], 0
mov dword [0x140256190], 1
jmp 0x1400d366f
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x22
nop
mov dword [0x140256190], 1
xor eax, eax
jmp 0x1400d366f
lea rdi, str.unknown
mov qword [rax + 8], rdi
jmp 0x1400d372b
call fcn.1401d96b0
nop
nop dword [rax + rax]

Function at 0x1400d3d70
Capabilities:
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x358
mov rbp, qword [0x14022c040]
mov rdi, qword [rbp]
mov qword [rsp + 0x348], rdi
lea rdi, [rsp + 0x240]
mov qword [rsp + 0x28], r8
mov esi, r9d
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, edx
lea r8, str._.s_s.exe
mov edx, 0x104
mov rcx, rdi
call sub.libintl_8.dll_libintl_snprintf
mov r9d, 0xffffffff
mov rdx, rdi
mov rcx, rbx
mov r8d, 0x104
call fcn.1400d25c0
test eax, eax
js 0x1400d3e80
xor r9d, r9d
mov r8d, 0x104
mov edx, eax
mov rcx, rbx
call fcn.1400d3b90
test eax, eax
js 0x1400d3e30
test esi, esi
je 0x1400d3e50
mov rcx, rbx
call sub.msvcrt.dll_wcslen
xor ecx, ecx
mov rsi, qword [sym.imp.msvcrt.dll__waccess]
mov word [rsp + rax*2 + 0x28], cx
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
jne 0x1400d3e30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x1400d3ea0
nop word [rax + rax]
xor eax, eax
mov rdx, qword [rsp + 0x348]
sub rdx, qword [rbp]
jne 0x1400d3ebd
add rsp, 0x358
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor edx, edx
mov rsi, qword [sym.imp.msvcrt.dll__waccess]
mov rcx, rbx
call rsi
test eax, eax
je 0x1400d3eb0
mov rcx, rbx
call sub.msvcrt.dll_wcslen
xor edx, edx
cmp dword [rsp + 0x3a0], 1
mov word [rsp + rax*2 + 0x28], dx
je 0x1400d3e30
jmp 0x1400d3e0f
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
jne 0x1400d3e30
call rbx
mov dword [rax], 0x26
jmp 0x1400d3e30
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov byte [rsp + rax + 0x23c], 0
mov rcx, rdi
call fcn.1400bd080
jmp 0x1400d3e32
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop
Function at 0x1400d4a20
Capabilities:
Check if file exists
Create directory
Get disk information
Get token membership
Query environment variable

Disassembly:
push rbp
mov eax, 0x2048
push rdi
push rsi
push rbx
call fcn.1401d92a0
sub rsp, rax
mov rsi, qword [0x14022c040]
mov rdx, qword [rsi]
mov qword [rsp + 0x2038], rdx
xor edx, edx
mov rdi, rcx
call fcn.1400d3780
test eax, eax
je 0x1400d4c0f
call fcn.1400d1230
lea rbx, [rsp + 0x30]
mov r9d, 0xffffffff
mov rdx, rdi
mov r8d, 0x1000
mov rcx, rbx
mov ebp, eax
call fcn.1400d25c0
test eax, eax
js 0x1400d4ac8
mov r9d, ebp
mov r8d, 0xf8
mov edx, eax
mov rcx, rbx
call fcn.1400d3b90
test eax, eax
js 0x1400d4ada
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wmkdir]
mov ebp, eax
test eax, eax
je 0x1400d4ae8
mov rax, qword [rsp + 0x2038]
sub rax, qword [rsi]
jne 0x1400d4c20
mov eax, ebp
add rsp, 0x2048
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400d4bf8
mov ebp, 0xffffffff
jmp 0x1400d4aa2
call fcn.1400d1060
mov eax, dword [0x1401e4954]
mov qword [rsp + 0x28], rdi
test eax, eax
je 0x1400d4aa2
lea rcx, [rsp + 0x28]
call fcn.1400db0f0
mov rdx, qword [rsp + 0x28]
movzx ecx, byte [rdx]
test cl, cl
je 0x1400d4aa2
mov rdi, rdx
jmp 0x1400d4b39
mov rax, rdx
cmp cl, 0x5c
je 0x1400d4b3e
lea rdx, [rax + 1]
mov qword [rsp + 0x28], rdx
movzx ecx, byte [rax + 1]
test cl, cl
je 0x1400d4b90
cmp cl, 0x2f
jne 0x1400d4b20
add rdx, 1
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop dword [rax + rax]
mov qword [rsp + 0x28], rdx
movsx r8d, byte [rdx]
mov rax, rdx
lea rdx, [rdx + 1]
cmp r8b, 0x2f
je 0x1400d4b60
cmp r8d, 0x5c
je 0x1400d4b60
test r8b, r8b
je 0x1400d4b90
mov rdi, rax
jmp 0x1400d4b28
mov eax, dword [0x1401e4954]
cmp eax, 1
je 0x1400d4c05
cmp eax, 2
jne 0x1400d4c25
mov r8d, 4
mov rdx, rdi
lea rcx, str..git
call qword [sym.imp.msvcrt.dll__strnicmp_1]
test eax, eax
jne 0x1400d4aa2
movzx eax, byte [rdi + 4]
test al, al
je 0x1400d4be0
movsx edx, al
cmp al, 0x2f
je 0x1400d4be0
cmp edx, 0x5c
jne 0x1400d4aa2
nop word [rax + rax]
mov edx, 1
mov rcx, rbx
call fcn.1400d10f0
mov ebp, eax
jmp 0x1400d4aa2
call rbx
mov dword [rax], 0x26
jmp 0x1400d4ada
cmp byte [rdi], 0x2e
je 0x1400d4be0
jmp 0x1400d4aa2
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x1400d4ada
call fcn.1401d96b0
call fcn.1400d0120
nop
nop dword [rax + rax]
Function at 0x1400d6820
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push r13
mov eax, 0x3058
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1401d92a0
sub rsp, rax
mov rdi, qword [0x14022c040]
mov rbx, rcx
lea r13, [rsp + 0x40]
mov rbp, rdx
mov rsi, r8
mov rax, qword [rdi]
mov qword [rsp + 0x3048], rax
xor eax, eax
call fcn.1400d1230
mov r9d, 0xffffffff
mov rdx, rbx
mov rcx, r13
mov r8d, 0x1000
mov r12d, eax
call fcn.1400d25c0
test eax, eax
js 0x1400d6910
mov r9d, r12d
mov r8d, 0x104
mov edx, eax
mov rcx, r13
call fcn.1400d3b90
test eax, eax
js 0x1400d691e
lea rax, [rsp + 0x3c]
lea r12, [rsp + 0x2040]
mov edx, 1
mov rcx, r13
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov r8, r12
call fcn.1400d2ba0
cmp eax, 0xffffffff
je 0x1400d691e
movsxd rbx, dword [rsp + 0x38]
mov rdx, r12
mov rcx, rbp
lea r8d, [rbx + 1]
movsxd r8, r8d
cmp r8, rsi
cmova r8, rsi
call sub.msvcrt.dll_memcpy
cmp rbx, rsi
cmovbe rsi, rbx
mov rax, rsi
mov rdx, qword [rsp + 0x3048]
sub rdx, qword [rdi]
jne 0x1400d6932
add rsp, 0x3058
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400d6928
mov eax, 0xffffffff
jmp 0x1400d68ed
call rbx
mov dword [rax], 0x26
jmp 0x1400d691e
call fcn.1401d96b0
nop
nop dword [rax + rax]

Function at 0x1400d6940
Capabilities:
Check if file exists
Delete directory
Delete file
Get common file path
Timestomp file

Disassembly:
push r13
mov eax, 0x2048
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1401d92a0
sub rsp, rax
mov rdi, qword [0x14022c040]
mov rsi, rcx
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x2c], 0
mov rax, qword [rdi]
mov qword [rsp + 0x2038], rax
xor eax, eax
call fcn.1400d1230
mov r9d, 0xffffffff
mov rdx, rsi
mov rcx, rbx
mov r8d, 0x1000
mov ebp, eax
call fcn.1400d25c0
test eax, eax
js 0x1400d6a50
mov r9d, ebp
mov r8d, 0x104
mov edx, eax
mov rcx, rbx
call fcn.1400d3b90
test eax, eax
js 0x1400d6a01
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400d6a70
mov r12, qword [sym.imp.msvcrt.dll__wchmod]
mov rbp, qword [sym.imp.msvcrt.dll__wunlink]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, 0x1b6
call r12
mov rcx, rbx
call rbp
test eax, eax
je 0x1400d6a70
call r13
cmp eax, 5
je 0x1400d6a28
cmp eax, 0x20
je 0x1400d6a28
mov eax, 0xffffffff
mov rdx, qword [rsp + 0x2038]
sub rdx, qword [rdi]
jne 0x1400d6a74
add rsp, 0x2048
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wrmdir]
test eax, eax
je 0x1400d6a70
lea rcx, [rsp + 0x2c]
mov r8, rsi
lea rdx, str.Unlink_of_file__s_failed._Should_I_try_again_
call fcn.1400d3470
test eax, eax
jne 0x1400d69dc
jmp 0x1400d6a01
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
jne 0x1400d6a01
call rbx
mov dword [rax], 0x26
jmp 0x1400d6a01
xor eax, eax
jmp 0x1400d6a06
call fcn.1401d96b0
nop
nop word [rax + rax]
Function at 0x1400d6a80
Capabilities:
Check if file exists
Get common file path
Read file on windows
Timestomp file

Disassembly:
push r13
mov eax, 0x2288
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1401d92a0
sub rsp, rax
mov rbx, qword [0x14022c040]
mov rax, qword [rbx]
mov qword [rsp + 0x2278], rax
xor eax, eax
mov rbp, rcx
lea rsi, [rsp + 0x20]
mov ecx, 0x4a
mov r13, qword [rbp + 0x10]
mov rdi, rsi
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x270]
call fcn.1400d1230
mov r9d, 0xffffffff
mov rdx, r13
mov rcx, rdi
mov r8d, 0x1000
mov r12d, eax
call fcn.1400d25c0
test eax, eax
js 0x1400d6b90
mov r9d, r12d
mov r8d, 0x104
mov edx, eax
mov rcx, rdi
call fcn.1400d3b90
test eax, eax
js 0x1400d6b9e
jne 0x1400d6b58
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x1400d6b2e
call qword [sym.imp.KERNEL32.dll_FindClose]
test byte [rsp + 0x21], 4
jne 0x1400d6b78
xor eax, eax
mov rdx, qword [rsp + 0x2278]
sub rdx, qword [rbx]
jne 0x1400d6bd4
add rsp, 0x2288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
sub eax, 1
cdqe
cmp word [rsp + rax*2 + 0x270], 0x2f
jne 0x1400d6b0c
xor edx, edx
mov word [rsp + rax*2 + 0x270], dx
jmp 0x1400d6b0c
xor eax, eax
cmp dword [rsp + 0x44], 0xa0000003
sete al
jmp 0x1400d6b30
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400d6bc0
mov rax, qword [str.PF__]
mov rbx, qword [rbp + 0x10]
lea rcx, str.could_not_get_long_path_for__s
cmp dword [rax], 0
jne 0x1400d6bca
mov rdx, rbx
call fcn.1400b6950
nop dword [rax]
call rbx
mov dword [rax], 0x26
jmp 0x1400d6b9e
call fcn.1401d81b8
mov rcx, rax
jmp 0x1400d6bb5
call fcn.1401d96b0
nop
nop word [rax + rax]
Function at 0x1400d6be0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push r12
mov eax, 0x4030
push rbp
push rdi
push rsi
push rbx
call fcn.1401d92a0
sub rsp, rax
mov rdi, qword [0x14022c040]
mov rax, qword [rdi]
mov qword [rsp + 0x4028], rax
xor eax, eax
mov rbx, rcx
lea rbp, [rsp + 0x20]
mov rsi, rdx
call fcn.1400d1230
mov r9d, 0xffffffff
mov rdx, rbx
mov rcx, rbp
mov r8d, 0x1000
mov r12d, eax
call fcn.1400d25c0
test eax, eax
js 0x1400d6cc8
mov r9d, r12d
mov r8d, 0x104
mov edx, eax
mov rcx, rbp
call fcn.1400d3b90
test eax, eax
js 0x1400d6cd6
call fcn.1400d1230
lea r12, [rsp + 0x2020]
mov r9d, 0xffffffff
mov rdx, rsi
mov r8d, 0x1000
mov rcx, r12
mov ebx, eax
call fcn.1400d25c0
test eax, eax
js 0x1400d6cc8
mov r9d, ebx
mov r8d, 0x104
mov edx, eax
mov rcx, r12
call fcn.1400d3b90
test eax, eax
js 0x1400d6cd6
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
test eax, eax
je 0x1400d6cef
xor eax, eax
mov rdx, qword [rsp + 0x4028]
sub rdx, qword [rdi]
jne 0x1400d6d0b
add rsp, 0x4030
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400d6ce0
mov eax, 0xffffffff
jmp 0x1400d6caa
call rbx
mov dword [rax], 0x26
mov eax, 0xffffffff
jmp 0x1400d6caa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, esi
mov rbx, rax
call fcn.1400d0b80
mov dword [rbx], eax
jmp 0x1400d6cd6
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400d6d20
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rbp
mov eax, 0x2058
push rdi
push rsi
push rbx
call fcn.1401d92a0
sub rsp, rax
mov rdi, qword [0x14022c040]
mov rax, qword [rdi]
mov qword [rsp + 0x2048], rax
xor eax, eax
mov rsi, rcx
lea rbx, [rsp + 0x40]
call fcn.1400d1230
mov r9d, 0xffffffff
mov rdx, rsi
mov rcx, rbx
mov r8d, 0x1000
mov ebp, eax
call fcn.1400d25c0
test eax, eax
js 0x1400d6e38
mov r9d, ebp
mov r8d, 0x104
mov edx, eax
mov rcx, rbx
call fcn.1400d3b90
test eax, eax
js 0x1400d6e46
mov rax, qword [0x14022c5d0]
mov eax, dword [rax]
test eax, eax
je 0x1400d6df7
mov dword [rsp + 0x28], 0x2000000
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400d6e7f
xor r9d, r9d
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
test eax, eax
je 0x1400d6e5a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1400cfc50
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wchdir]
xor edx, edx
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [0x140256d28], eax
mov rax, qword [rsp + 0x2048]
sub rax, qword [rdi]
jne 0x1400d6e9b
mov eax, ebx
add rsp, 0x2058
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400d6e50
mov ebx, 0xffffffff
jmp 0x1400d6e1a
call rbx
mov dword [rax], 0x26
jmp 0x1400d6e46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, ebp
mov rbx, rax
call fcn.1400d0b80
mov rcx, rsi
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400d6e46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, esi
mov rbx, rax
call fcn.1400d0b80
mov dword [rbx], eax
jmp 0x1400d6e46
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400d6eb0
Capabilities:
Check if file exists

Disassembly:
push r12
mov eax, 0x2070
push rbp
push rdi
push rsi
push rbx
call fcn.1401d92a0
sub rsp, rax
mov r12, qword [0x14022c040]
mov rax, qword [r12]
mov qword [rsp + 0x2068], rax
xor eax, eax
mov rbx, rcx
lea rbp, [rsp + 0x60]
mov rdi, rdx
call fcn.1400d1230
mov r9d, 0xffffffff
mov rdx, rbx
mov rcx, rbp
mov r8d, 0x1000
mov esi, eax
call fcn.1400d25c0
test eax, eax
js 0x1400d7030
mov r9d, esi
mov r8d, 0x104
mov edx, eax
mov rcx, rbp
call fcn.1400d3b90
test eax, eax
js 0x1400d703e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
je 0x1400d6f49
test bl, 1
jne 0x1400d7018
mov eax, ebx
shl eax, 0x15
and eax, 0x2000000
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
mov qword [rsp + 0x30], 0
mov rcx, rbp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400d7090
test rdi, rdi
je 0x1400d7060
imul rax, qword [rdi + 8], 0x989680
lea r9, [rsp + 0x50]
movabs rdx, 0x19db1ded53e8000
add rax, rdx
mov qword [rsp + 0x50], rax
imul rax, qword [rdi], 0x989680
add rax, rdx
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, rsi
xor edi, edi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x1400d7048
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
je 0x1400d6fdf
test bl, 1
jne 0x1400d7008
mov rax, qword [rsp + 0x2068]
sub rax, qword [r12]
jne 0x1400d70c5
mov eax, edi
add rsp, 0x2070
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov edx, ebx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1400d6fdf
mov edx, ebx
mov rcx, rbp
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1400d6f3f
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400d70b8
mov edi, 0xffffffff
jmp 0x1400d6fdf
call qword [sym.imp.msvcrt.dll__errno]
mov edi, 0xffffffff
mov dword [rax], 0x16
jmp 0x1400d6fcc
lea r9, [rsp + 0x50]
mov qword [rsp + 0x48], r9
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
jmp 0x1400d6fb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, edi
mov edi, 0xffffffff
mov rsi, rax
call fcn.1400d0b80
mov dword [rsi], eax
jmp 0x1400d6fd5
call rbx
mov dword [rax], 0x26
jmp 0x1400d703e
call fcn.1401d96b0
nop
nop dword [rax + rax]
Function at 0x1400d8040
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sub.msvcrt.dll_strlen
cmp eax, 3
jle 0x1400d8070
cdqe
lea rdx, [0x140205812]
lea rcx, [rbx + rax - 4]
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
je 0x1400d8140
mov rcx, rbx
xor edx, edx
call fcn.1400d7b40
mov ebx, eax
test eax, eax
js 0x1400d8140
lea rdi, [0x140256be0]
mov ecx, eax
mov r8d, 0x103
mov rdx, rdi
call sub.msvcrt.dll__read
mov ecx, ebx
movsxd rsi, eax
call sub.msvcrt.dll__close
cmp esi, 3
jle 0x1400d8140
cmp byte [0x140256be0], 0x23
jne 0x1400d8140
cmp byte [0x140256be1], 0x21
jne 0x1400d8140
mov rcx, rdi
lea rdx, [0x140205dc5]
mov byte [rdi + rsi], 0
call sub.msvcrt.dll_strcspn
add rdi, rax
cmp byte [rdi], 0
je 0x1400d8140
mov byte [rdi], 0
lea rbx, [0x140256be2]
mov edx, 0x2f
mov rcx, rbx
call sub.msvcrt.dll_strrchr
test rax, rax
je 0x1400d8120
lea rbx, [rax + 1]
mov edx, 0x20
mov rcx, rbx
call sub.msvcrt.dll_strchr
test rax, rax
je 0x1400d8142
mov byte [rax], 0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x5c
mov rcx, rbx
call sub.msvcrt.dll_strrchr
test rax, rax
jne 0x1400d80fb
nop word cs:[rax + rax]
nop dword [rax]
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400d8a40
Capabilities:
Check if file exists
Copy file
Delete directory
Get file attributes
Move file
Set file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x14022c040]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov eax, dword [0x1401e47e0]
mov qword [rsp + 0x30], 0
cmp eax, 0xffffffff
je 0x1400d8a80
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rbx]
jne 0x1400d8ac8
add rsp, 0x40
pop rbx
ret
lea rax, [rsp + 0x30]
xor r8d, r8d
mov r9d, 0x20019
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetServicescexecsvc
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x30]
test eax, eax
sete al
movzx eax, al
mov dword [0x1401e47e0], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1401e47e0]
jmp 0x1400d8a6a
call fcn.1401d96b0
nop
nop