joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ced40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1403cd210]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, r8
mov r15, rdx
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x50], r8
xor r13d, r13d
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
lea rdx, str.__record.created.seconds
lea rcx, [rsp + 0x60]
call fcn.140031d84
lea r8, [rsp + 0x60]
mov r10, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
cmp rsi, 8
cmovae r8, r10
movabs rdx, 0xcbf29ce484222325
mov r11, qword [rsp + 0x70]
lea r9, [r11 + r11]
mov ecx, r13d
test r9, r9
je 0x1400cedf4
movabs rbx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, rbx
inc rcx
cmp rcx, r9
jb 0x1400cede0
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r14 + 8]
je 0x1400cee80
mov rdi, qword [rax + rcx*8]
lea rax, [rbx + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x1400cee23
mov rax, qword [rax]
lea r9, [rsp + 0x60]
cmp rsi, 8
cmovae r9, r10
cmp r11, rcx
jne 0x1400cee70
mov rcx, r11
test r11, r11
je 0x1400cee7b
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x1400cee70
sub r9, rax
cmp dx, r8w
ja 0x1400cee70
cmp rcx, 1
je 0x1400cee7b
dec rcx
add rax, 2
movzx edx, word [rax + r9]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x1400cee52
cmp rbx, rdi
je 0x1400cee80
mov rbx, qword [rbx + 8]
jmp 0x1400cee11
test rbx, rbx
jne 0x1400cee84
mov rbx, qword [r14 + 8]
mov qword [rsp + 0x40], rbx
cmp rsi, 8
jb 0x1400ceec4
lea rdx, [rsi*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x1400ceebc
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cefc3
mov rcx, r10
call fcn.14011a254
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r13w
cmp rbx, qword [r14 + 8]
je 0x1400cef46
cmp qword [rbx + 0x40], r13
je 0x1400cef46
call fcn.140141530
mov rdi, rax
add rbx, 0x30
cmp qword [rbx + 0x18], 8
jb 0x1400ceefa
mov rbx, qword [rbx]
mov dword [rax], r13d
mov r8d, 0xa
lea rdx, [rsp + 0x88]
mov rcx, rbx
call fcn.1401427e4
cmp rbx, qword [rsp + 0x88]
je 0x1400cefc9
cmp dword [rdi], 0x22
je 0x1400cefd5
imul rcx, rax, 0x3b9aca00
mov qword [r15], rcx
mov rax, r15
jmp 0x1400cef9b
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.1400b2ef0
call fcn.1400f655c
mov rbx, rax
call fcn.1400f645c
mov rdi, rax
call fcn.1400f6440
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rdx, rcx, 0x3b9aca00
add rdx, rax
mov rax, qword [rsp + 0x50]
sub rax, rbx
imul rcx, rax, 0x64
add rcx, rdx
mov qword [r15], rcx
mov rax, r15
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140119fe0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call fcn.14013d31c
nop
lea rcx, str.invalid_stoull_argument
call fcn.1400f520c
lea rcx, str.stoull_argument_out_of_range
call fcn.1400f5254
int3
Function at 0x1400d0db0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rdx + 0x18]
mov rbx, rdx
mov rdi, qword [rdx + 0x10]
mov r11, rcx
mov r9, rdx
cmp rsi, 8
jb 0x1400d0dd9
mov r9, qword [rdx]
lea r10, [rdi + rdi]
xor edx, edx
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x1400d0e14
movabs rcx, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rdx + r9]
inc rdx
xor r8, rax
imul r8, rcx
cmp rdx, r10
jb 0x1400d0e00
mov rcx, qword [r11 + 0x30]
mov rax, qword [r11 + 0x18]
and rcx, r8
add rcx, rcx
mov r10, qword [rax + rcx*8 + 8]
cmp r10, qword [r11 + 8]
je 0x1400d0ebe
mov r11, qword [rax + rcx*8]
nop word [rax + rax]
cmp qword [r10 + 0x28], 8
lea rax, [r10 + 0x10]
mov rcx, qword [rax + 0x10]
jb 0x1400d0e52
mov rax, qword [rax]
mov r9, rbx
cmp rsi, 8
jb 0x1400d0e5e
mov r9, qword [rbx]
cmp rdi, rcx
jne 0x1400d0e9a
mov r8, rdi
test rdi, rdi
je 0x1400d0ea5
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x1400d0e9a
sub r9, rax
cmp cx, dx
ja 0x1400d0e9a
cmp r8, 1
je 0x1400d0ea5
movzx ecx, word [r9 + rax + 2]
add rax, 2
dec r8
movzx edx, word [rax]
cmp cx, dx
jae 0x1400d0e7d
cmp r10, r11
je 0x1400d0ebe
mov r10, qword [r10 + 8]
jmp 0x1400d0e40
test r10, r10
je 0x1400d0ebe
mov rbx, qword [rsp + 0x30]
lea rax, [r10 + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1400f5254
int3
Function at 0x1400d5190
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1403cd210]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x1400d51c1
xor eax, eax
jmp 0x1400d530f
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1400d51fe
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x1400d51fe
lea ecx, [r10 - 1]
movzx eax, si
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x1400d530f
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x1400d5304
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400d5245
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400d526e
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.14015c35c
cmp ax, di
je 0x1400d5304
movzx edi, si
jmp 0x1400d5304
lea r8, [rsp + 0x40]
mov word [rsp + 0x50], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x52]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x1400d5304
cmp eax, 1
jle 0x1400d52c4
cmp eax, 3
jne 0x1400d5304
movzx ecx, word [rsp + 0x50]
jmp 0x1400d5251
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x1400d52f1
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.140160afc
cmp rbp, rax
jne 0x1400d5304
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
movzx eax, si
jne 0x1400d5307
movzx eax, di
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140119fe0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400d57a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1403cd210]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400d5874
cmp byte [rcx + 0x72], 0
je 0x1400d5874
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x1400d5870
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1400d5836
sub eax, 1
je 0x1400d583a
cmp eax, 2
jne 0x1400d5870
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140119fe0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400d5867
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140160afc
cmp rdi, rax
jne 0x1400d5870
cmp byte [rbx + 0x72], 0
sete al
jmp 0x1400d581e
xor al, al
jmp 0x1400d581e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140119fe0
add rsp, 0x60
pop rbx
ret
Function at 0x1400d7e20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1403cd210]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, rcx
mov qword [rsp + 0x58], rcx
mov ecx, 0x80
call fcn.14011a288
mov rbx, rax
mov qword [rsp + 0x88], rax
xor esi, esi
mov dword [rax + 8], esi
lea rax, vtable.contextsubscriber.0
mov qword [rbx], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbx + 0x20], xmm1
lea rcx, [rbx + 0x30]
lea edx, [rsi + 2]
call fcn.1400f6158
nop
mov eax, 9
mov word [rdi], ax
mov qword [rdi + 8], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
lea rcx, [rdi + 0x18]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rbx, [rdi + 0x30]
mov qword [rsp + 0x88], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
je 0x1400d7fca
mov qword [rbx + 8], rax
lea rbx, [rdi + 0x40]
mov qword [rsp + 0x88], rbx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
je 0x1400d7f87
mov qword [rbx + 8], rax
mov byte [rdi + 0x50], sil
lea ecx, [rsi + 8]
call fcn.14011a288
mov qword [rax], rdi
mov qword [rsp + 0x88], rax
lea rbx, [rdi + 0x60]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1400d80d0]
xor edx, edx
xor ecx, ecx
call fcn.1401474d8
mov qword [rdi + 0x58], rax
test rax, rax
je 0x1400d7fbd
mov rax, rdi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140119fe0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ebx, eax
call fcn.1400474a0
mov r8, rax
lea r9, str.Failed_to_create_event
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.1400d82d0
lea rdx, [0x1403c7ab0]
lea rcx, [rsp + 0x60]
call fcn.1401388cc
nop
mov dword [rbx], esi
mov ecx, 6
call fcn.1400f62f8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.1400474a0
mov r8, rax
lea r9, str.Failed_to_create_event
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1400d82d0
lea rdx, [0x1403c7ab0]
lea rcx, [rsp + 0x30]
call fcn.1401388cc
int3
Function at 0x1400ddc50
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, rcx
cmp qword [rcx + 0x10], rbx
je 0x1400ddd10
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400ddd10
test rdx, rdx
je 0x1400ddcae
test r8, r8
je 0x1400ddcb3
xor r9d, r9d
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov dword [rsp + 0x38], eax
lea rcx, [rsp + 0x30]
lea rax, vtable.McCryptoLib::CWinError.0
mov qword [rsp + 0x30], rax
call qword [0x14037d3c8]
test eax, eax
jne 0x1400ddcba
mov byte [rdi + 8], 1
jmp 0x1400ddd0c
test r8, r8
je 0x1400ddc80
mov eax, 0x8000000a
jmp 0x1400ddd15
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call qword [rax + 8]
mov ecx, eax
call fcn.1400c67e0
mov qword [rsp + 0x28], rax
lea r8, str.E:BT_a76716fc_23e4_48c9_a49e_4f088d2116acCoreTechMcCryptoLib_srcwindowswin_hash.cpp
lea rax, str.McCryptoLib::CMcCryptoHashWin::AddToHash
mov r9d, 0x90
lea rdx, str.__S:__d____S___s:_Error_trying_to_add_data_for_hashing
mov qword [rsp + 0x20], rax
mov ecx, 2
call fcn.1400daa24
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call qword [rax + 8]
mov ebx, eax
mov eax, ebx
jmp 0x1400ddd15
mov eax, 0x8000000d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400de9e4
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r14, r9
mov r12, r8
mov r13, rdx
mov rsi, rcx
xor ebx, ebx
mov edi, ebx
mov ebp, ebx
mov r15d, ebx
mov dword [rax + 8], ebx
lea rdx, [rax - 0x48]
call fcn.1400debbc
nop
cmp byte [rsp + 0xd0], bl
je 0x1400dea42
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
sub rdi, rbx
mov rbp, qword [rsi + 0x20]
mov r15d, dword [r14]
mov eax, dword [rsi + 0x78]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, r12d
mov rdx, r13
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
mov dword [rsp + 0x58], eax
lea rax, vtable.McCryptoLib::CWinError.0
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0xb0]
mov qword [r14], rax
lea rcx, [rsp + 0x50]
call qword [0x14037d3c8]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.1400a1bb0
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400dead0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r14, r9
mov r12, r8
mov r13, rdx
mov rsi, rcx
xor ebx, ebx
mov edi, ebx
mov ebp, ebx
mov r15d, ebx
mov dword [rax + 8], ebx
lea rdx, [rax - 0x48]
call fcn.1400debbc
nop
cmp byte [rsp + 0xd0], bl
je 0x1400deb2e
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
sub rdi, rbx
mov rbp, qword [rsi + 0x20]
mov r15d, dword [r14]
mov eax, dword [rsi + 0x78]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, r12d
mov rdx, r13
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov dword [rsp + 0x58], eax
lea rax, vtable.McCryptoLib::CWinError.0
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0xb0]
mov qword [r14], rax
lea rcx, [rsp + 0x50]
call qword [0x14037d3c8]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.1400a1bb0
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400dfa20
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1403cd210]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
mov eax, r8d
mov edi, r8d
xor edi, 8
and al, 8
cmove edi, r8d
test rcx, rcx
jne 0x1400dfa59
xor eax, eax
jmp 0x1400dfaff
xor ebp, ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140315f28]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x28], rbx
test eax, eax
jns 0x1400dfa88
mov edi, ebp
jmp 0x1400dfaee
mov r9, rsi
mov r8, rbx
lea rdx, str._s_s
lea rcx, [rsp + 0x30]
call fcn.140032048
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400dfadb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
call fcn.1400331fc
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
test rbx, rbx
je 0x1400dfafc
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140119fe0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400dfa20
Function at 0x1400dfb20
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1403cd210]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
mov eax, r8d
mov edi, r8d
xor edi, 8
and al, 8
cmove edi, r8d
test rcx, rcx
jne 0x1400dfa59
xor eax, eax
jmp 0x1400dfaff
xor ebp, ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140315f28]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x28], rbx
test eax, eax
jns 0x1400dfa88
mov edi, ebp
jmp 0x1400dfaee
mov r9, rsi
mov r8, rbx
lea rdx, str._s_s
lea rcx, [rsp + 0x30]
call fcn.140032048
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400dfadb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
call fcn.1400331fc
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
test rbx, rbx
je 0x1400dfafc
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140119fe0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400dfa20
Function at 0x1400e02d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400e02f6
xor eax, eax
cmp ax, word [rcx]
je 0x1400e02f6
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e02f6
test al, 0x10
je 0x1400e02f6
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x1400e0ae0
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1403cd210]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
test rcx, rcx
je 0x1400e0bcd
xor eax, eax
cmp ax, word [rcx]
je 0x1400e0bcd
cmp word [rcx], 0x2e
jne 0x1400e0b33
cmp word [rcx + 2], ax
je 0x1400e0bcd
cmp word [rcx], 0x2e
jne 0x1400e0b33
cmp word [rcx + 2], 0x2e
jne 0x1400e0b33
cmp word [rcx + 4], ax
je 0x1400e0bcd
call fcn.1400e02d0
test al, al
je 0x1400e0bcd
mov r8, rbx
lea rdx, str._s.
lea rcx, [rsp + 0x20]
call fcn.140032048
nop
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
mov dl, 1
call fcn.1400dfe80
test al, al
jne 0x1400e0b75
xor bl, bl
jmp 0x1400e0b9a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400e0bb7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
call fcn.1400331fc
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140119fe0
add rsp, 0x50
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140119fe0
add rsp, 0x50
pop rbx
ret
Function at 0x1400e12d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400395f8
mov rcx, rax
test rax, rax
je 0x1400e1465
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
xor ebp, ebp
mov edi, ebp
nop dword [rax + rax]
lea edx, [rdi + 1]
test edx, edx
js 0x1400e145a
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x1400e133b
lea rcx, [rsp + 0x48]
call fcn.140039050
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 8], 1
jle 0x1400e1353
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140039200
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov ecx, dword [rbx - 0xc]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
je 0x1400e13dc
test rbx, rbx
jne 0x1400e136e
mov eax, ebp
jmp 0x1400e1382
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14014789c
test eax, eax
js 0x1400e145a
cmp eax, dword [rbx - 0xc]
jg 0x1400e145a
mov dword [rbx - 0x10], eax
mov eax, eax
mov word [rbx + rax*2], bp
cmp edi, dword [rbx - 0x10]
ja 0x1400e1310
lea rcx, [rbx - 0x18]
call fcn.140056890
add rax, 0x18
mov qword [rsi], rax
mov rdi, 0xffffffffffffffff
lock xadd dword [rbx - 8], edi
sub edi, 1
jg 0x1400e13cc
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + 8]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
call fcn.1400395f8
nop
mov rcx, rax
test rax, rax
je 0x1400e144f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x140355f14]
mov rdi, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x1400e141b
movzx edx, dx
mov rcx, rsi
call fcn.14003812c
jmp 0x1400e1436
mov rax, rdi
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400e1420
mov r8d, eax
mov rcx, rsi
call fcn.140038edc
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400e13cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
jmp 0x1400e13c9
mov ecx, 0x80004005
call fcn.140039608
int3
mov ecx, 0x80070057
call fcn.140039608
nop
mov ecx, 0x80004005
call fcn.140039608
int3
Function at 0x1400e1e10
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x20
cmp byte [rcx + 0x20], 0
mov rbx, rdx
mov rsi, rcx
jne 0x1400e1edb
cmp qword [rdx + 0x18], 8
mov rcx, rdx
mov dword [rsp + 0x50], 0
jb 0x1400e1e3d
mov rcx, qword [rdx]
lea rdx, [rsp + 0x50]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x1400e1edb
mov r9, qword [rsi + 0x10]
mov edx, ebp
mov r8, qword [rsi + 8]
mov rcx, r9
sub rcx, r8
mov qword [rsp + 0x48], rdi
cmp rbp, rcx
jae 0x1400e1e71
lea rax, [r8 + rbp]
jmp 0x1400e1e9e
jbe 0x1400e1ea2
mov rax, qword [rsi + 0x18]
sub rax, r8
cmp rdx, rax
jbe 0x1400e1e8f
lea r8, [rsp + 0x40]
lea rcx, [rsi + 8]
call fcn.1400530cc
jmp 0x1400e1ea2
sub rdx, rcx
lea r8, [rsi + 8]
mov rcx, r9
call fcn.1400df068
mov qword [rsi + 0x10], rax
mov rcx, qword [rsi + 8]
call fcn.140031f20
cmp qword [rbx + 0x18], 8
mov rdi, qword [rsp + 0x48]
jb 0x1400e1eba
mov rbx, qword [rbx]
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, 1
sete al
mov byte [rsi + 0x20], al
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
xor al, al
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400e43b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
test rdx, rdx
je 0x1400e4403
lea r9, [rsp + 0x38]
mov qword [rsp + 0x38], 0
xor r8d, r8d
lea rcx, [0x140315ed8]
mov edx, 0x8000
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rbx, qword [rsp + 0x38]
test eax, eax
jns 0x1400e4418
test rbx, rbx
je 0x1400e4403
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 0x57
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r9, 0xffffffffffffffff
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140147ccc
mov edi, eax
test rbx, rbx
je 0x1400e443d
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e53a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x40
mov edi, r8d
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400e54a3
xor ebp, ebp
cmp bp, word [rdx]
je 0x1400e54a3
cmp qword [rcx + 0x50], rbp
je 0x1400e53d8
mov eax, 0xb7
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x60], rsi
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0xa0
mov rcx, rax
mov esi, ebp
mov dword [rsp + 0x20], edi
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov rax, qword [rbx + 0x50]
push rax
mov qword [rbx + 0x50], rcx
test rax, rax
je 0x1400e5428
cmp rax, 0xffffffffffffffff
je 0x1400e5428
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x50]
cmp rcx, 0xffffffffffffffff
jne 0x1400e5447
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov qword [rbx + 0x50], rbp
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
cmp edi, 3
jne 0x1400e546a
lea r9d, [rdi - 1]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400e5494
lea r9, [rsp + 0x78]
mov word [rsp + 0x68], 0xfeff
mov r8d, 2
mov qword [rsp + 0x20], rbp
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
mov eax, 0x57
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret