joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x68], rax
call fcn.140001cc0
test al, al
je 0x14000525c
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001f5c0
add rsp, 0x70
pop rbx
ret
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.140001f84
nop
mov edx, 4
lea rcx, [rsp + 0x28]
call fcn.140007cd0
lea rcx, [rsp + 0x28]
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400052d5
lea rcx, [rsp + 0x48]
call fcn.140001f6c
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.1400139e0
test al, al
je 0x1400052c6
lea rcx, [rsp + 0x48]
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.140001dd0
cmp ebx, 0xffffffff
je 0x1400052de
test bl, 0x10
je 0x1400053b6
lea rcx, [rsp + 0x28]
call fcn.1400020d4
cmp rax, 2
jbe 0x1400053b2
lea rcx, [rsp + 0x28]
call fcn.1400020d4
mov r8, rax
lea rcx, [rsp + 0x28]
call fcn.140002040
mov rdx, rax
mov rcx, rax
mov r9, qword [rax + 0x18]
cmp r9, 8
jb 0x14000531c
mov rcx, qword [rax]
cmp word [rcx + r8*2 - 2], 0x5c
je 0x140005342
lea rcx, [rsp + 0x28]
call fcn.1400020d4
dec rax
cmp r9, 8
jb 0x14000533b
mov rdx, qword [rdx]
cmp word [rdx + rax*2], 0x2f
jne 0x1400053b2
mov edx, 0x20
lea rcx, [rsp + 0x28]
call fcn.140007cd0
lea rcx, [rsp + 0x28]
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400053ad
lea rcx, [rsp + 0x48]
call fcn.140001f6c
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.1400139e0
test al, al
je 0x14000539e
lea rcx, [rsp + 0x48]
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.140001dd0
cmp ebx, 0xffffffff
je 0x1400053b2
test bl, 0x10
je 0x1400053b6
xor bl, bl
jmp 0x1400053b8
mov bl, 1
lea rcx, [rsp + 0x28]
call fcn.140001dd0
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001f5c0
add rsp, 0x70
pop rbx
ret
Function at 0x1400053e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x68], rax
call fcn.140001cc0
test al, al
je 0x14000541c
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001f5c0
add rsp, 0x70
pop rbx
ret
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.140001f84
nop
mov edx, 4
lea rcx, [rsp + 0x28]
call fcn.140007cd0
lea rcx, [rsp + 0x28]
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140005495
lea rcx, [rsp + 0x48]
call fcn.140001f6c
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.1400139e0
test al, al
je 0x140005486
lea rcx, [rsp + 0x48]
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.140001dd0
cmp ebx, 0xffffffff
je 0x14000549e
test bl, 0x10
je 0x14000549e
mov bl, 1
jmp 0x1400054a0
xor bl, bl
lea rcx, [rsp + 0x28]
call fcn.140001dd0
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001f5c0
add rsp, 0x70
pop rbx
ret
Function at 0x140005af0
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov rbx, rcx
mov rcx, rdx
call fcn.140001ccc
mov rdx, rax
mov rcx, rbx
call fcn.140001ccc
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140005bc9
xor sil, sil
lea rcx, [rsp + 0x48]
call fcn.140001f6c
nop
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400139e0
movzx ebx, sil
mov ecx, 1
test al, al
cmovne ebx, ecx
lea rcx, [rsp + 0x28]
call fcn.140001f6c
nop
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1400139e0
test al, al
jne 0x140005b8d
test bl, bl
je 0x140005bcd
lea rcx, [rsp + 0x28]
call fcn.140001ccc
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140001ccc
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140005bcd
lea rcx, [rsp + 0x28]
call fcn.140001dd0
nop
lea rcx, [rsp + 0x48]
call fcn.140001dd0
mov al, 1
jmp 0x140005be4
lea rcx, [rsp + 0x28]
call fcn.140001dd0
nop
lea rcx, [rsp + 0x48]
call fcn.140001dd0
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001f5c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140005c10
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
call fcn.140001cc0
test al, al
je 0x140005c53
xor al, al
jmp 0x140005e15
call fcn.1400053e0
test al, al
je 0x140005c63
mov al, 1
jmp 0x140005e15
mov rcx, rsi
call fcn.140001ccc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140005cb2
lea rcx, [rbp - 0x48]
call fcn.140001f6c
nop
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.1400139e0
test al, al
je 0x140005ca9
lea rcx, [rbp - 0x48]
call fcn.140001ccc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rbp - 0x48]
call fcn.140001dd0
mov rcx, rsi
call fcn.1400053e0
test al, al
jne 0x140005c5c
mov rcx, rsi
call fcn.1400020d4
mov r14, rax
xor ebx, ebx
test rax, rax
je 0x140005db2
call fcn.140002040
mov rdi, rax
lea r12d, [rbx + 0x2f]
lea r15d, [rbx + 0x5c]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rdi
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140005d00
mov rcx, qword [rdi]
cmp r12w, word [rcx + rbx*2]
je 0x140005d1e
mov rax, rdi
cmp rdx, 8
jb 0x140005d13
mov rax, qword [rdi]
cmp r15w, word [rax + rbx*2]
jne 0x140005da6
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.140003700
nop
lea rcx, [rbp - 0x48]
call fcn.140001cc0
test al, al
jne 0x140005d9d
lea rcx, [rbp - 0x48]
call fcn.140005060
test al, al
jne 0x140005d9d
lea rcx, [rbp - 0x48]
call fcn.140001ccc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140005d9d
lea rcx, [rbp - 0x28]
call fcn.140001f6c
nop
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x48]
call fcn.1400139e0
test al, al
je 0x140005d93
lea rcx, [rbp - 0x28]
call fcn.140001ccc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rbp - 0x28]
call fcn.140001dd0
nop
lea rcx, [rbp - 0x48]
call fcn.140001dd0
inc rbx
cmp rbx, r14
jb 0x140005cf0
mov rcx, rsi
call fcn.140005060
test al, al
jne 0x140005e0d
mov rcx, rsi
call fcn.140001ccc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140005e0d
lea rcx, [rbp - 0x28]
call fcn.140001f6c
nop
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.1400139e0
test al, al
je 0x140005e04
lea rcx, [rbp - 0x28]
call fcn.140001ccc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rbp - 0x28]
call fcn.140001dd0
mov rcx, rsi
call fcn.1400053e0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001f5c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400069a0
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140001ccc
mov rdx, rax
mov rcx, rsi
call fcn.140001ccc
mov rcx, rax
mov r8d, 0xb
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140006ae5
xor dil, dil
lea rcx, [rsp + 0x68]
call fcn.140001f6c
nop
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.1400139e0
movzx edi, dil
mov ecx, 1
test al, al
cmovne edi, ecx
lea rcx, [rsp + 0x48]
call fcn.140001f6c
nop
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400139e0
test al, al
jne 0x140006a47
test dil, dil
je 0x140006a71
lea rcx, [rsp + 0x48]
call fcn.140001ccc
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140001ccc
mov rcx, rax
mov r8d, 0xb
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140006ad0
mov rcx, rbx
call fcn.140012a40
cmp eax, 0xffffffff
je 0x140006afd
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140001f84
nop
lea rcx, [rsp + 0x28]
call fcn.140013420
test al, al
je 0x140006af2
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140012ad0
test al, al
je 0x140006af2
mov rdx, rbx
mov rcx, rsi
call fcn.140012ad0
lea rcx, [rsp + 0x28]
test al, al
je 0x140006ae9
call fcn.140012be0
nop
lea rcx, [rsp + 0x28]
call fcn.140001dd0
nop
lea rcx, [rsp + 0x48]
call fcn.140001dd0
nop
lea rcx, [rsp + 0x68]
call fcn.140001dd0
mov al, 1
jmp 0x140006b14
mov rdx, rbx
call fcn.140012ad0
nop
lea rcx, [rsp + 0x28]
call fcn.140001dd0
nop
lea rcx, [rsp + 0x48]
call fcn.140001dd0
nop
lea rcx, [rsp + 0x68]
call fcn.140001dd0
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14001f5c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140007060
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
mov rbx, rcx
mov qword [rcx], r8
mov word [rcx + 8], r8w
mov rcx, rdx
call fcn.140001cc0
test al, al
jne 0x140007088
call fcn.140001ccc
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x1400070b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov rax, rbx
jne 0x1400070b7
mov byte [rbx + 9], 1
add rsp, 0x20
pop rbx
ret
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400070f0
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rdx
mov rsi, rcx
mov rcx, qword [rcx]
xor r14d, r14d
test rcx, rcx
je 0x140007134
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], r14
mov word [rsi + 8], r14w
mov qword [rsp + 0x48], r14
mov ecx, 0x58
call fcn.14001f5e4
mov rbx, rax
mov qword [rsp + 0x48], rax
mov qword [rax], r14
mov qword [rax + 8], r14
mov dword [rax + 0x10], 0x18
lea rdi, [rax + 0x28]
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], r14d
lea rdx, str.Advapi32.dll
lea rcx, [rsp + 0x28]
call fcn.140001ed4
nop
call fcn.140014280
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.140014350
mov qword [rbx + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.140001dd0
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140013ee0
mov rbx, qword [rsp + 0x48]
mov qword [rbx], rax
cmp qword [rbx], 0
lea r9, [rbx + 0x10]
jne 0x1400071c4
mov r9, r14
mov rcx, rbp
call fcn.140001cc0
test al, al
jne 0x1400071d7
call fcn.140001ccc
jmp 0x1400071da
mov rax, r14
mov r8, rax
xor edx, edx
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi], rax
test rax, rax
je 0x140007201
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140007201
mov byte [rsi + 9], 1
cmp qword [rsi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x140007228
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000723b
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], r14
mov edx, 0x58
mov rcx, rbx
call fcn.14001f8d4
mov qword [rsp + 0x48], r14
movzx eax, sil
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001f5c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000a730
Capabilities:
Set file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebp, r9d
mov rsi, r8
mov r14, rdx
mov r15d, dword [rsp + 0xc8]
mov dword [rsp + 0x20], r15d
mov r12d, dword [rsp + 0xc0]
mov r9d, r12d
mov r8d, ebp
mov rdx, rsi
mov rcx, r14
call fcn.140012800
movzx ebx, al
test al, al
jne 0x14000a875
test ebp, 0x50000000
je 0x14000a81e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000a81e
mov rcx, rsi
call fcn.140001ccc
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14000a801
lea rcx, [rsp + 0x38]
call fcn.140001f6c
nop
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1400139e0
test al, al
je 0x14000a7f7
lea rcx, [rsp + 0x38]
call fcn.140001ccc
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop
lea rcx, [rsp + 0x38]
call fcn.140001dd0
mov dword [rsp + 0x20], r15d
mov r9d, r12d
mov r8d, ebp
mov rdx, rsi
mov rcx, r14
call fcn.140012800
movzx ebx, al
test al, al
jne 0x14000a875
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xffffffe0
cmp eax, 1
ja 0x14000a875
xor ebx, ebx
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], r15d
mov r9d, r12d
mov r8d, ebp
mov rdx, rsi
mov rcx, r14
call fcn.140012800
movzx edi, al
test al, al
jne 0x14000a86f
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xffffffe0
cmp eax, 1
ja 0x14000a86f
inc rbx
cmp rbx, 0x28
jb 0x14000a830
movzx eax, dil
jmp 0x14000a878
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001f5c0
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000ebd0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.14001f5e4
mov qword [rbx], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov byte [rax], 0
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x14000ec37
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14001f5c0
add rsp, 0x150
pop rbx
ret
Function at 0x140010be0
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
add rcx, 4
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140010d42
cmp dword [rbx + 4], 6
mov qword [rsp + 0x188], rdi
ja 0x140010c44
jne 0x140010ce5
cmp dword [rbx + 8], 2
jb 0x140010ce5
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x140010ce5
mov edx, 1
mov rcx, rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140010ce5
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140010ce5
movups xmm0, xmmword [0x140033308]
mov rcx, rax
movups xmm1, xmmword [0x140033318]
movups xmmword [rsp + 0x140], xmm0
movups xmmword [rsp + 0x150], xmm1
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x140010ce5
lea rcx, [rax + 6]
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140010ce5
cmp word [rdi + 2], ax
jbe 0x140010ce5
movzx edx, word [rdi + 0x32]
movzx eax, word [rdi + 0x30]
movzx ecx, word [rdi + 0x36]
mov dword [rbx + 4], edx
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], ecx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140010d36
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call rdi
test eax, eax
jne 0x140010d36
mov eax, dword [rsp + 0x2c]
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x188]
mov al, 1
jmp 0x140010d44
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14001f5c0
add rsp, 0x170
pop rbx
ret
Function at 0x140012990
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebx, edx
mov rdi, rcx
and ebx, 0xffffb1af
call fcn.140001ccc
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400129d6
mov al, 1
jmp 0x140012a1e
lea rcx, [rsp + 0x28]
call fcn.140001f6c
nop
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1400139e0
test al, al
je 0x140012a0f
lea rcx, [rsp + 0x28]
call fcn.140001ccc
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140012a0f
mov bl, 1
jmp 0x140012a11
xor bl, bl
lea rcx, [rsp + 0x28]
call fcn.140001dd0
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001f5c0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140012a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140012ab8
lea rcx, [rsp + 0x28]
call fcn.140001f6c
nop
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1400139e0
test al, al
je 0x140012aac
lea rcx, [rsp + 0x28]
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x28]
call fcn.140001dd0
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001f5c0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140012ad0
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov rbx, rcx
mov rcx, rdx
call fcn.140001ccc
mov rdx, rax
mov rcx, rbx
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140012ba3
xor sil, sil
lea rcx, [rsp + 0x48]
call fcn.140001f6c
nop
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400139e0
movzx ebx, sil
mov ecx, 1
test al, al
cmovne ebx, ecx
lea rcx, [rsp + 0x28]
call fcn.140001f6c
nop
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1400139e0
test al, al
jne 0x140012b6a
test bl, bl
je 0x140012ba7
lea rcx, [rsp + 0x28]
call fcn.140001ccc
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x140012ba7
lea rcx, [rsp + 0x28]
call fcn.140001dd0
nop
lea rcx, [rsp + 0x48]
call fcn.140001dd0
mov al, 1
jmp 0x140012bbe
lea rcx, [rsp + 0x28]
call fcn.140001dd0
nop
lea rcx, [rsp + 0x48]
call fcn.140001dd0
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14001f5c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140012be0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140012c29
mov al, 1
jmp 0x140012db7
mov rcx, rdi
call fcn.140001ccc
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140001ed4
nop
lea rcx, [rbp - 0x28]
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x140012c90
lea rcx, [rbp - 0x48]
call fcn.140001f6c
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.1400139e0
test al, al
je 0x140012c86
lea rcx, [rbp - 0x48]
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
lea rcx, [rbp - 0x48]
call fcn.140001dd0
nop
lea rcx, [rbp - 0x28]
call fcn.140001dd0
cmp esi, 0xffffffff
jne 0x140012ca5
xor al, al
jmp 0x140012db7
mov rcx, rdi
call fcn.140001ccc
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140001ed4
nop
lea rcx, [rbp - 0x28]
call fcn.140001ccc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140012cd6
xor bl, bl
jmp 0x140012d21
lea rcx, [rbp - 0x48]
call fcn.140001f6c
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.1400139e0
test al, al
je 0x140012d16
lea rcx, [rbp - 0x48]
call fcn.140001ccc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140012d16
lea rcx, [rbp - 0x48]
call fcn.140001dd0
xor bl, bl
jmp 0x140012d21
lea rcx, [rbp - 0x48]
call fcn.140001dd0
mov bl, 1
lea rcx, [rbp - 0x28]
call fcn.140001dd0
test bl, bl
jne 0x140012c9e
mov rcx, rdi
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140012c22
lea rcx, [rbp - 0x28]
call fcn.140001f6c
nop
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.1400139e0
test al, al
je 0x140012d7f
lea rcx, [rbp - 0x28]
call fcn.140001ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140012d7f
mov bl, 1
jmp 0x140012dab
mov rcx, rdi
call fcn.140001ccc
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140001ed4
nop
mov edx, esi
lea rcx, [rbp - 0x48]
call fcn.140012990
nop
lea rcx, [rbp - 0x48]
call fcn.140001dd0
xor bl, bl
lea rcx, [rbp - 0x28]
call fcn.140001dd0
movzx eax, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001f5c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400150c0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, pe_nt_image_headers64
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140015147
cmp dword [rsp + 0x44], 6
jb 0x140015147
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str.Progid
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
call fcn.140014f70
test al, al
je 0x140015147
cmp word [rbx], 0
jne 0x1400151b1
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call fcn.140014f70
test al, al
je 0x14001517c
cmp word [rbx], 0
jne 0x1400151b1
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClasses.html
mov rcx, 0xffffffff80000001
call fcn.140014f70
test al, al
je 0x1400151b5
cmp word [rbx], 0
je 0x1400151b5
mov al, 1
jmp 0x1400151b7
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14001f5c0
add rsp, 0x170
pop rbx
ret