joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400085e0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x3e8]
sub rsp, 0x4e0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
movaps xmm0, xmmword [str.SoftwareMicrosoftWindowsCurrentVersionRun]
movaps xmmword [rbp - 0x50], xmm0
movaps xmm1, xmmword [0x1400f5a30]
movaps xmmword [rbp - 0x40], xmm1
movaps xmm0, xmmword [0x1400f5a40]
movaps xmmword [rbp - 0x30], xmm0
movaps xmm1, xmmword [0x1400f5a50]
movaps xmmword [rbp - 0x20], xmm1
movaps xmm0, xmmword [0x1400f5a60]
movaps xmmword [rbp - 0x10], xmm0
movsd xmm1, qword [0x1400f5a70]
movsd qword [rbp], xmm1
mov eax, dword [0x1400f5a78]
mov dword [rbp + 8], eax
xor edx, edx
mov r8d, 0x1ac
lea rcx, [rbp + 0xc]
call fcn.1400a8b60
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400086ef
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x1c0]
call fcn.1400a8b60
mov dword [rsp + 0x30], 0x208
mov dword [rsp + 0x34], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.haozipcd
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x1400086f6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400087ef
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x1400fe370]
movdqu xmmword [rsp + 0x78], xmm1
xor ebx, ebx
mov word [rsp + 0x68], bx
lea r8d, [rbx + 0xc]
lea rdx, str.HaoZipCD.exe
lea rcx, [rsp + 0x68]
call fcn.1400025d0
nop
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.140017718
nop
lea rcx, [rsp + 0x68]
call fcn.140002550
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x1400fe370]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], bx
lea rax, [rbp + 0x1c0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140008774
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x48]
call fcn.1400025d0
nop
lea rcx, [rsp + 0x48]
call fcn.1400025c0
mov rdi, rax
lea rcx, [rbp - 0x78]
call fcn.1400025c0
cmp rax, rdi
cmovae rdi, rax
lea rcx, [rsp + 0x48]
call fcn.1400024e0
mov rbx, rax
lea rcx, [rbp - 0x78]
call fcn.1400024e0
mov rcx, rax
mov r8, rdi
mov rdx, rbx
call fcn.14001f1b0
test eax, eax
sete bl
lea rcx, [rsp + 0x48]
call fcn.140002550
nop
lea rcx, [rbp - 0x78]
call fcn.140002550
nop
movzx eax, bl
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.1400a6810
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14000ceb0
Capabilities:
Get disk information

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov edx, 0x7550
lea rcx, [rsp + 0x58]
call fcn.140008820
nop
movzx eax, byte [rbx + 4]
xor r14d, r14d
test al, al
je 0x14000d011
movdqa xmm0, xmmword [0x1400fe370]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r14w
movsx r8d, al
lea rdx, str._c:_
lea rcx, [rsp + 0x78]
call fcn.14001f9d0
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0x40], r14d
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
mov dword [rsp + 0x38], 0x104
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8d, 0x104
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x14000cfb9
lea rax, [rbp - 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000cfa0
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400025d0
mov edx, 0x7553
lea rcx, [rbp - 0x68]
call fcn.140008820
nop
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
cmp qword [rax + 0x18], 8
jb 0x14000cfe3
mov rax, qword [rax]
movsx r9d, byte [rbx + 4]
mov qword [rsp + 0x20], rcx
mov r8, rax
lea rdx, str._s__c:__s
mov rcx, rdi
call fcn.14001f9d0
nop
lea rcx, [rbp - 0x68]
call fcn.140002550
nop
lea rcx, [rsp + 0x78]
jmp 0x14000d052
mov edx, 0x7553
lea rcx, [rbp - 0x68]
call fcn.140008820
nop
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r9, qword [rsp + 0x58]
cmp qword [rax + 0x18], 8
jb 0x14000d03b
mov rax, qword [rax]
mov r8, rax
lea rdx, str._s_s
mov rcx, rdi
call fcn.14001f9d0
nop
lea rcx, [rbp - 0x68]
call fcn.140002550
mov r8, rdi
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.14000cc70
mov rbx, rax
cmp rdi, rax
je 0x14000d094
mov rcx, rdi
call fcn.140002550
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rcx, [rbp - 0x68]
call fcn.140002550
nop
lea rcx, [rsp + 0x58]
call fcn.140002550
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.1400a6810
add rsp, 0x4f0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140017484
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x788]
sub rsp, 0x880
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rbp + 0x770], rax
lea rax, [0x140137550]
mov qword [rsp + 0x28], rax
mov rcx, qword [0x140137550]
xor edi, edi
test rcx, rcx
je 0x1400174d9
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov eax, dword [0x140137a48]
test al, 1
jne 0x140017507
or eax, 1
mov dword [0x140137a48], eax
mov qword [0x140137a38], rdi
mov byte [0x140137a40], dil
lea rcx, [0x1400e24dc]
call fcn.1400a6be4
nop
cmp byte [0x140137a40], dil
jne 0x140017644
mov byte [0x140137a40], 1
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x40]
call fcn.1400a8b60
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x20]
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x140017573
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x14001756e
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140017573
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x140017573
mov word [rsp + 0x40], di
lea rdx, [0x1400f96d4]
lea rcx, [rsp + 0x40]
call fcn.1400b13a0
lea rdx, [0x1400f9920]
lea rcx, [rsp + 0x40]
call fcn.1400b13a0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400175aa
mov word [rsp + 0x40], di
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp + 0x350]
call fcn.1400a8b60
lea rcx, [rsp + 0x40]
call fcn.1400ae760
test rax, rax
je 0x14001761b
mov r8d, 0x207
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x350]
call fcn.1400b1358
lea rcx, [rbp + 0x350]
call fcn.1400ae760
test rax, rax
je 0x14001761b
lea rdx, [0x1400f96d4]
lea rcx, [rbp + 0x350]
call fcn.1400b13a0
lea rdx, str.HaoZip.hzv
lea rcx, [rbp + 0x350]
call fcn.1400b13a0
call fcn.140024650
mov rbx, rax
lea rcx, [rbp + 0x350]
call fcn.1400ae760
test rax, rax
je 0x140017644
lea rdx, [rbp + 0x350]
mov rcx, rbx
call fcn.140024720
nop
mov rcx, qword [0x140137550]
test rcx, rcx
je 0x140017656
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x28], rdi
lea rax, [0x140137a38]
mov rcx, qword [rbp + 0x770]
xor rcx, rsp
call fcn.1400a6810
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14001851c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], 0x114
mov r8d, 0x110
lea rcx, [rsp + 0x24]
call fcn.1400a8b60
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140018572
cmp dword [rsp + 0x24], 5
ja 0x14001856e
jne 0x140018572
cmp dword [rsp + 0x28], 0
jbe 0x140018572
mov al, 1
jmp 0x140018574
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a6810
add rsp, 0x158
ret
Function at 0x14001858c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], 0x114
mov r8d, 0x110
lea rcx, [rsp + 0x24]
call fcn.1400a8b60
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400185d6
cmp dword [rsp + 0x24], 6
setae al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a6810
add rsp, 0x158
ret

Function at 0x1400185f0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor edi, edi
mov rbx, rcx
mov qword [rcx], rdi
cmp qword [0x140133f50], rdi
jne 0x140018676
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
call fcn.1400a8b60
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rax, [rsp + 0x30]
mov word [rsp + 0x236], di
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x14001865b
lea rdx, [rsp + 0x30]
lea rcx, [0x140133f40]
call fcn.1400025d0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400a6810
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x140018728
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x260
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r14, rcx
mov eax, dword [0x140137460]
xor r15d, r15d
test eax, eax
jle 0x140018785
lea edi, [r15 + 1]
add eax, edi
mov dword [0x140137460], eax
jmp 0x140018893
mov dil, r15b
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x30]
call fcn.140025070
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.140025e10
mov bl, al
lea rcx, [rsp + 0x30]
call fcn.1400250f0
test bl, bl
je 0x140018880
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140018880
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
call rax
test eax, eax
je 0x140018875
mov edi, 1
add dword [0x140137460], edi
mov rcx, qword [r14]
test rcx, rcx
je 0x140018810
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14], rbx
mov rbx, r15
cmp qword [0x140133f70], r15
jne 0x140018875
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x40]
call fcn.1400a8b60
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov word [rbp + 0x146], r15w
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x14001885a
lea rdx, [rsp + 0x40]
lea rcx, [0x140133f60]
call fcn.1400025d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140018885
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x140018893
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, dil
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1400a6810
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140019970
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], 0x114
mov r8d, 0x110
lea rcx, [rsp + 0x24]
call fcn.1400a8b60
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
test eax, eax
je 0x1400199c9
cmp dword [rsp + 0x24], 5
jae 0x1400199cb
cmp dword [rsp + 0x24], 4
jne 0x1400199c9
cmp dword [rsp + 0x28], 0x5a
jae 0x1400199cb
mov cl, 1
mov al, cl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400a6810
add rsp, 0x158
ret
Function at 0x14001edc0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov qword [rcx], rdi
mov rsi, rdx
mov word [rcx + 8], di
mov rcx, rdx
call fcn.1400024d0
test al, al
jne 0x14001edf5
mov rcx, rsi
call fcn.1400024e0
mov rdi, rax
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x14001ee2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov rax, rbx
jne 0x14001ee31
mov byte [rbx + 9], 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14001ee80
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rdx
mov rsi, rcx
mov rcx, qword [rcx]
xor r14d, r14d
test rcx, rcx
je 0x14001eec4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], r14
mov word [rsi + 8], r14w
mov qword [rsp + 0x48], r14
mov ecx, 0x58
call fcn.1400a683c
mov rdi, rax
mov qword [rsp + 0x48], rax
mov qword [rax], r14
mov qword [rax + 8], r14
mov dword [rax + 0x10], 0x18
lea rbx, [rax + 0x28]
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r14d
lea rdx, str.Advapi32.dll
lea rcx, [rsp + 0x28]
call fcn.140002500
nop
call fcn.14002cf30
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.14002cfd0
mov qword [rdi + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.1400024f0
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14002b550
mov rbx, qword [rsp + 0x48]
mov qword [rbx], rax
cmp qword [rbx], 0
lea rdi, [rbx + 0x10]
jne 0x14001ef4e
mov rdi, r14
mov rcx, rbp
call fcn.1400024d0
test al, al
jne 0x14001ef64
mov rcx, rbp
call fcn.1400024e0
jmp 0x14001ef67
mov rax, r14
mov r8, rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi], rax
test rax, rax
je 0x14001ef8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14001ef8e
mov byte [rsi + 9], 1
cmp qword [rsi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x14001efb5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001efc8
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], r14
mov edx, 0x58
mov rcx, rbx
call fcn.1400a6bfc
mov qword [rsp + 0x48], r14
movzx eax, sil
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a6810
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400205b0
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
call fcn.1400024d0
test al, al
je 0x1400205f3
xor al, al
jmp 0x1400207b5
mov rcx, rsi
call fcn.140020500
test al, al
je 0x140020606
mov al, 1
jmp 0x1400207b5
mov rcx, rsi
call fcn.1400024e0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140020655
lea rcx, [rbp - 0x48]
call fcn.140008be0
nop
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.14002c730
test al, al
je 0x14002064c
lea rcx, [rbp - 0x48]
call fcn.1400024e0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rbp - 0x48]
call fcn.1400024f0
mov rcx, rsi
call fcn.140020500
test al, al
jne 0x1400205ff
mov rcx, rsi
call fcn.1400025c0
mov r14, rax
xor ebx, ebx
test rax, rax
je 0x140020752
mov rcx, rsi
call fcn.140002540
mov rdi, rax
lea r12d, [rbx + 0x2f]
lea r15d, [rbx + 0x5c]
nop word [rax + rax]
mov rcx, rdi
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400206a0
mov rcx, qword [rdi]
cmp r12w, word [rcx + rbx*2]
je 0x1400206be
mov rax, rdi
cmp rdx, 8
jb 0x1400206b3
mov rax, qword [rdi]
cmp r15w, word [rax + rbx*2]
jne 0x140020746
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.140011bb8
nop
lea rcx, [rbp - 0x48]
call fcn.1400024d0
test al, al
jne 0x14002073d
lea rcx, [rbp - 0x48]
call fcn.1400202e0
test al, al
jne 0x14002073d
lea rcx, [rbp - 0x48]
call fcn.1400024e0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14002073d
lea rcx, [rbp - 0x28]
call fcn.140008be0
nop
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x48]
call fcn.14002c730
test al, al
je 0x140020733
lea rcx, [rbp - 0x28]
call fcn.1400024e0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rbp - 0x28]
call fcn.1400024f0
nop
lea rcx, [rbp - 0x48]
call fcn.1400024f0
inc rbx
cmp rbx, r14
jb 0x140020690
mov rcx, rsi
call fcn.1400202e0
test al, al
jne 0x1400207ad
mov rcx, rsi
call fcn.1400024e0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400207ad
lea rcx, [rbp - 0x28]
call fcn.140008be0
nop
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.14002c730
test al, al
je 0x1400207a4
lea rcx, [rbp - 0x28]
call fcn.1400024e0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rbp - 0x28]
call fcn.1400024f0
mov rcx, rsi
call fcn.140020500
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400a6810
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140020a40
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400024e0
mov rbx, rax
mov rcx, rsi
call fcn.1400024e0
mov rcx, rax
mov r8d, 0xb
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140020b88
xor bl, bl
lea rcx, [rsp + 0x68]
call fcn.140008be0
nop
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.14002c730
movzx ebx, bl
mov ecx, 1
test al, al
cmovne ebx, ecx
lea rcx, [rsp + 0x48]
call fcn.140008be0
nop
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.14002c730
test al, al
jne 0x140020ae7
test bl, bl
je 0x140020b14
lea rcx, [rsp + 0x48]
call fcn.1400024e0
mov rbx, rax
lea rcx, [rsp + 0x68]
call fcn.1400024e0
mov rcx, rax
mov r8d, 0xb
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140020b73
mov rcx, rdi
call fcn.14002bca0
cmp eax, 0xffffffff
je 0x140020ba0
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.140008c00
nop
lea rcx, [rsp + 0x28]
call fcn.14002c440
test al, al
je 0x140020b95
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14002bd30
test al, al
je 0x140020b95
mov rdx, rdi
mov rcx, rsi
call fcn.14002bd30
lea rcx, [rsp + 0x28]
test al, al
je 0x140020b8c
call fcn.14002bf60
nop
lea rcx, [rsp + 0x28]
call fcn.1400024f0
nop
lea rcx, [rsp + 0x48]
call fcn.1400024f0
nop
lea rcx, [rsp + 0x68]
call fcn.1400024f0
mov al, 1
jmp 0x140020bb7
mov rdx, rdi
call fcn.14002bd30
nop
lea rcx, [rsp + 0x28]
call fcn.1400024f0
nop
lea rcx, [rsp + 0x48]
call fcn.1400024f0
nop
lea rcx, [rsp + 0x68]
call fcn.1400024f0
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400a6810
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140020e00
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
call fcn.140011858
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x412
call fcn.1400a8b60
lea rdx, [rsp + 0x20]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x140020e4d
xor al, al
jmp 0x140020e7a
cmp eax, 0x208
jae 0x140020e49
xor eax, eax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x430], ax
call fcn.1400027f0
mov r8, rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400025d0
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400a6810
add rsp, 0x450
pop rbx
ret
Function at 0x140022e90
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rdx, qword [rcx + 0x10]
test rdx, rdx
jne 0x140022ecf
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a6810
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x38], 0
add rdx, 0x38
lea rcx, [rsp + 0x38]
call fcn.140011d7c
nop
mov rax, qword [rbx + 0x10]
cmp qword [rax + 8], 0
je 0x140022f58
mov eax, 1
lock xadd dword [rbx + 8], eax
mov rcx, qword [rbx + 0x10]
add rcx, 0x14
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x140022a90]
xor edx, edx
xor ecx, ecx
call fcn.1400b2078
mov rcx, qword [rbx + 0x10]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x10]
cmp qword [rax + 0x18], 0
jne 0x140022f7a
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
sub eax, 1
jne 0x140022f4f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rbx + 0x10]
call fcn.140022c20
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.140011da4
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a6810
add rsp, 0x50
pop rbx
ret
mov byte [rax + 0x10], 1
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x140022f98
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x140022f37
mov bl, 1
jmp 0x140022f5a

Function at 0x1400234e0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx]
test rax, rax
je 0x140023518
test rdx, rdx
je 0x140023518
cmp qword [rax], 0xffffffffffffffff
je 0x140023518
xor eax, eax
mov dword [r9], eax
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140023518
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret

Function at 0x140023520
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
mov edi, r8d
test rcx, rcx
je 0x14002356a
test rdx, rdx
je 0x14002356a
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x14002356a
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002356a
cmp edi, dword [rbx]
jne 0x14002356a
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x1400235c0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdi, rdx
test rcx, rcx
je 0x14002361e
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x14002361e
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140023609
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002361e
mov ecx, dword [rsp + 0x20]
mov rax, rbx
shl rcx, 0x20
mov al, 1
add rcx, rbx
mov qword [rdi], rcx
jmp 0x140023620
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a6810
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret