joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001e24
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x2048
call fcn.1400b1970
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov dword [rsp + 0x44], 0x1fa0
mov qword [rsp + 0x50], 0
lea rax, [0x1400b26f1]
mov qword [rsp + 0x48], rax
mov r8d, 0x1fa0
xor edx, edx
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCR120.dll_memset]
mov rcx, qword [rsp + 0x2050]
call qword [sym.imp.MSVCR120.dll_strlen]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x90]
mov r8d, 1
mov edx, eax
mov rcx, qword [rsp + 0x2050]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x140001fd3
call qword [0x1400c2368]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140001fc7
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x50]
call qword [0x1400c23b8]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140001fae
lea rax, [rsp + 0x90]
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x78]
call qword [0x1400c2388]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140001fa0
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCR120.dll_memcpy]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0x1fa0
jae 0x140001f7f
jmp 0x140001f84
call fcn.1400b1124
mov rax, qword [rsp + 0x58]
mov byte [rsp + rax + 0x90], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
jmp 0x140001fac
lea rax, str.Error_on_decryption_
mov qword [rsp + 0x48], rax
jmp 0x140001fba
lea rax, str.Error_on_authenticate_
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x50]
call qword [0x1400c2390]
jmp 0x140001fd3
lea rax, str.Get_Internal_Slot_error_
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1400b0ec0
add rsp, 0x2048
ret
Function at 0x14000257c
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rax, str.Path
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], 0
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathschrome.exe
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400025e8
xor eax, eax
jmp 0x140002675
mov byte [rsp + 0x60], 0
lea rax, [rsp + 0x61]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR120.dll_strlen]
inc rax
mov rcx, rax
call fcn.1400b0ea8
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR120.dll_strcpy]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400b0ec0
add rsp, 0x180
pop rdi
ret

Function at 0x140002690
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x880
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r8d, 0x400
mov rdx, qword [rsp + 0x890]
lea rcx, [rsp + 0x470]
call qword [sym.imp.MSVCR120.dll_memcpy]
mov dword [rsp + 0x44], 0x400
mov rax, qword [rsp + 0x890]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x60], eax
mov al, byte [0x1400b26f2]
mov byte [rsp + 0x70], al
lea rax, [rsp + 0x71]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x14000279b
mov dword [rsp + 0x40], 0
jmp 0x14000274b
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x40], eax
jae 0x14000276d
movsxd rax, dword [rsp + 0x40]
movsxd rcx, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
mov al, byte [rdx + rax]
mov byte [rsp + rcx + 0x70], al
jmp 0x140002741
mov eax, dword [rsp + 0x50]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0x400
jae 0x140002783
jmp 0x140002788
call fcn.1400b1124
mov rax, qword [rsp + 0x48]
mov byte [rsp + rax + 0x70], 0
lea rax, [rsp + 0x70]
jmp 0x14000279d
xor eax, eax
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.1400b0ec0
add rsp, 0x880
pop rdi
ret
Function at 0x1400027b8
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR120.dll_memset]
mov eax, dword [rsp + 0x48]
bts eax, 0xf
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, eax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x140002802
mov al, 1
jmp 0x140002804
xor al, al
add rsp, 0x38
ret

Function at 0x14000280c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x30]
call fcn.140003048
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14000288a
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140002884
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140002884
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140003150
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call fcn.1400030d4
lea rcx, [rsp + 0x30]
call fcn.140003130
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400b0ec0
add rsp, 0x68
ret

Function at 0x1400028bc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x20], 0
mov rcx, qword [rsp + 0xa8]
call fcn.1400031a4
mov rcx, rax
call qword [sym.imp.MSVCR120.dll_getenv]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140002920
or dword [rsp + 0x20], 1
lea rcx, [rsp + 0x60]
call fcn.140003048
mov qword [rsp + 0x28], rax
jmp 0x140002939
or dword [rsp + 0x20], 2
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140003084
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xa0]
call fcn.1400030d4
mov eax, dword [rsp + 0x20]
and eax, 2
test eax, eax
je 0x14000296f
and dword [rsp + 0x20], 0xfffffffd
lea rcx, [rsp + 0x40]
call fcn.140003130
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140002989
and dword [rsp + 0x20], 0xfffffffe
lea rcx, [rsp + 0x60]
call fcn.140003130
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400b0ec0
add rsp, 0x98
ret
Function at 0x140002f00
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.140002a14
cmp eax, dword [0x1400ba024]
jg 0x140002f66
call fcn.140002a14
cmp eax, dword [0x1400ba024]
jne 0x140002f3f
call fcn.1400029e0
cmp eax, dword [0x1400ba028]
jg 0x140002f66
call fcn.140002a14
cmp eax, dword [0x1400ba024]
jne 0x140002f79
call fcn.1400029e0
cmp eax, dword [0x1400ba028]
jne 0x140002f79
call fcn.1400029ac
cmp eax, dword [0x1400ba020]
jle 0x140002f79
mov ecx, 0x270f
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.MSVCR120.dll_exit]
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x20], 0
jmp 0x140002f9d
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x4c4b400
jge 0x140002fb3
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
jmp 0x140002f93
cmp dword [rsp + 0x24], 0x4c4b400
jne 0x140002fd4
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400c2768]
call fcn.140002a4c
xor eax, eax
add rsp, 0x38
ret
Function at 0x14000bf2c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov ecx, 0x28
call fcn.140008698
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14000bf6c
mov eax, 7
jmp 0x14000c041
cmp dword [0x1400c1a34], 0
je 0x14000bf83
mov ecx, 0xc8
call fcn.14000d15c
test eax, eax
je 0x14000bf98
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCR120.dll_memset]
jmp 0x14000c006
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [0x14000bef0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.MSVCR120.dll__beginthreadex]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x14000c006
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCR120.dll_memset]
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0
jne 0x14000c032
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x48
ret
Function at 0x14002d9b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x80]
call qword [rax + 0x80]
mov rax, qword [rsp + 0x90]
movzx ecx, word [rsp + 0x66]
mov word [rax], cx
movzx eax, word [rsp + 0x64]
cmp eax, dword [rsp + 0x60]
jne 0x14002da21
xor eax, eax
jmp 0x14002dbc2
movzx eax, word [rsp + 0x66]
mov rcx, qword [rsp + 0x88]
lea rax, [rcx + rax - 1]
mov rcx, qword [rsp + 0x80]
movzx ecx, word [rcx + 0x14]
mov rdx, qword [rsp + 0x80]
add rcx, qword [rdx + 0x50]
cmp rax, rcx
jbe 0x14002da5f
mov ecx, 0xfaf9
call fcn.1400afe08
jmp 0x14002dbc2
movzx eax, word [rsp + 0x66]
mov rcx, qword [rsp + 0x88]
lea rax, [rcx + rax - 4]
mov rcx, rax
call fcn.14000f070
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x34]
sub eax, 4
mov dword [rsp + 0x3c], eax
movzx eax, word [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x3c]
lea eax, [rax + rcx - 1]
xor edx, edx
div dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x48], 0
je 0x14002dbc0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x20], 2
jb 0x14002daf0
mov rcx, qword [rsp + 0x40]
call fcn.1400276c4
cmp dword [rsp + 0x20], eax
jbe 0x14002daff
mov ecx, 0xfb09
call fcn.1400afe08
jmp 0x14002dbc2
cmp dword [rsp + 0x28], 0
je 0x14002db32
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call fcn.14002ad64
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14002db32
mov eax, dword [rsp + 0x24]
jmp 0x14002dbc2
cmp qword [rsp + 0x30], 0
jne 0x14002db55
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call fcn.14002767c
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14002db78
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x70]
call fcn.14001f2b0
cmp eax, 1
je 0x14002db78
mov ecx, 0xfb1d
call fcn.1400afe08
mov dword [rsp + 0x24], eax
jmp 0x14002db90
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call fcn.14002d5bc
mov dword [rsp + 0x24], eax
cmp qword [rsp + 0x30], 0
je 0x14002dba6
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x70]
call fcn.14001e234
cmp dword [rsp + 0x24], 0
je 0x14002dbb3
mov eax, dword [rsp + 0x24]
jmp 0x14002dbc2
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
jmp 0x14002daab
xor eax, eax
add rsp, 0x78
ret
Function at 0x140001998
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov rbp, r8
mov r15, rdx
mov rsi, rcx
cmp r8, rdi
jne 0x1400019cb
mov al, 1
jmp 0x140001b3d
cmp dword [rcx + 0x14], 1
jne 0x1400019e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsi + 8], rax
mov r12b, dil
mov dword [rsp + 0x70], edi
cmp dword [rsi + 0x14], edi
je 0x140001a3d
mov rbx, rdi
cmp rbp, rdi
jbe 0x140001a67
mov r8d, 0x4000
mov eax, ebp
mov rcx, rbp
sub rcx, rbx
sub eax, ebx
lea rdx, [rbx + r15]
cmp rcx, r8
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x70]
cmovb r8d, eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete r12b
cmp r12b, dil
je 0x140001a67
add rbx, 0x4000
cmp rbx, rbp
jb 0x1400019f4
jmp 0x140001a5e
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x70]
mov r8d, ebp
mov rdx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete r12b
cmp r12b, dil
jne 0x140001b36
cmp byte [rsi + 0x1c], dil
je 0x140001b36
cmp dword [rsi + 0x14], edi
jne 0x140001b36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsi]
mov rcx, rsi
mov edi, eax
call qword [rdx + 0x20]
lea rcx, [rsi + 0x26]
mov r13, rax
call fcn.140002008
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rbx, rbp
jbe 0x140001ad1
mov rcx, r13
mov ebx, 0xffffffff
sub rcx, rbp
cmp rcx, rbx
ja 0x140001ad1
lea rax, [r13 + rbp]
cmp rax, rbx
jbe 0x140001ad1
lea rdx, [rsi + 0x26]
lea rcx, [0x140027bc0]
call fcn.140001510
lea rdx, [rsi + 0x26]
lea rcx, [0x140027bc0]
xor r8d, r8d
call fcn.140001380
xor edi, edi
cmp al, dil
je 0x140001b24
mov ecx, dword [rsp + 0x70]
mov rax, rcx
cmp rcx, rbp
jae 0x1400019e0
cmp ecx, edi
jbe 0x1400019e0
mov rbx, qword [rsi]
mov rcx, rsi
call qword [rbx + 0x20]
mov ecx, dword [rsp + 0x70]
xor r8d, r8d
sub rax, rcx
mov rcx, rsi
mov rdx, rax
call qword [rbx + 0x18]
jmp 0x1400019e0
lea r8, [rsi + 0x26]
lea rcx, [0x140027bc0]
xor edx, edx
call fcn.140008864
mov byte [rsi + 0x10], 1
mov al, r12b
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001cfc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jne 0x140001d29
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001da8
mov rcx, rbx
call fcn.140001be8
test al, al
je 0x140001d6c
mov r8d, 0x4e20
cmp rdi, r8
jbe 0x140001d6c
mov rdx, rsi
mov rcx, rbx
call fcn.140001cfc
jmp 0x140001dac
cmp dword [rbx + 0x14], 1
jne 0x140001d81
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x140001d81
xor eax, eax
jmp 0x140001dac
cmp dword [rbx + 0x14], 0
jne 0x140001da3
cmp rdi, 0x8000
jbe 0x140001da3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x140001da3
mov r8d, 0x8000
jmp 0x140001d5f
or eax, 0xffffffff
jmp 0x140001dac
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140002008
Capabilities:
Get disk size

Disassembly:
mov eax, 0x1058
call fcn.14001b9f0
sub rsp, rax
mov rax, qword [0x1400242f8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rdx, [rsp + 0x40]
mov r8d, 0x800
call fcn.140005a88
movzx eax, word [rsp + 0x40]
and dword [rsp + 0x24], 0
and dword [rsp + 0x20], 0
neg ax
lea rax, [rsp + 0x40]
sbb rcx, rcx
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
and rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x140002084
mov eax, dword [rsp + 0x24]
cmp eax, dword [rsp + 0x2c]
ja 0x140002084
mov ecx, dword [rsp + 0x20]
shl rax, 0x20
add rax, rcx
jmp 0x140002086
xor eax, eax
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14000a670
add rsp, 0x1058
ret

Function at 0x1400020c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.14001b9f0
sub rsp, rax
mov rax, qword [0x1400242f8]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140002119
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rdi
call fcn.1400057f4
test al, al
je 0x140002119
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000a670
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret
Function at 0x14000213c
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1030
call fcn.14001b9f0
sub rsp, rax
mov rax, qword [0x1400242f8]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov edi, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test bl, bl
jne 0x1400021a3
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rsi
call fcn.1400057f4
test al, al
je 0x1400021a3
lea rcx, [rsp + 0x20]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000a670
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400021cc
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.14001b9f0
sub rsp, rax
mov rax, qword [0x1400242f8]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test bl, bl
jne 0x14000222a
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rdi
call fcn.1400057f4
test al, al
je 0x14000222a
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000a670
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret

Function at 0x14000226c
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1030
call fcn.14001b9f0
sub rsp, rax
mov rax, qword [0x1400242f8]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov esi, r8d
mov dil, dl
mov rbx, rcx
call fcn.140005590
cmp word [rax], 0x2e
je 0x1400022bf
cmp word [rax], 0x20
je 0x1400022bf
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400022f4
mov rcx, rbx
call fcn.1400020c0
cmp eax, 0xffffffff
jne 0x140002307
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rbx
call fcn.1400057f4
test al, al
je 0x140002307
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140002307
test dil, dil
je 0x140002303
mov edx, esi
mov rcx, rbx
call fcn.14000213c
xor eax, eax
jmp 0x140002321
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000231c
cmp eax, 3
mov eax, 1
jne 0x140002321
mov eax, 2
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000a670
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140002a78
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
mov eax, 0x1280
call fcn.14001b9f0
sub rsp, rax
mov rax, qword [0x1400242f8]
xor rax, rsp
mov qword [rsp + 0x1270], rax
mov rsi, rdx
mov rdi, r8
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov r12d, 0x800
cmp rcx, 0xffffffffffffffff
jne 0x140002b2c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002b56
lea rdx, [rsp + 0x270]
mov r8, r12
mov rcx, rsi
call fcn.1400057f4
test al, al
je 0x140002b03
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002b56
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140002b1f
cmp eax, 3
je 0x140002b1f
cmp eax, 0x12
je 0x140002b1f
mov eax, 1
jmp 0x140002b21
xor eax, eax
mov byte [rdi + 0x1044], al
jmp 0x140002bec
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140002b4c
or rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [rdi + 0x1044], al
cmp rbx, 0xffffffffffffffff
je 0x140002bec
mov r8, r12
mov rdx, rsi
mov rcx, rdi
call fcn.140008534
lea rdx, [rsp + 0x4c]
mov r8, r12
mov rcx, rdi
call fcn.140005a40
mov eax, dword [rsp + 0x40]
mov r11d, dword [rsp + 0x3c]
shl r11, 0x20
lea rcx, [rdi + 0x1010]
lea rdx, [rsp + 0x34]
add r11, rax
mov eax, dword [rsp + 0x20]
mov dword [rdi + 0x1008], eax
mov rax, qword [rsp + 0x24]
mov qword [rdi + 0x1000], r11
mov qword [rdi + 0x1028], rax
mov rax, qword [rsp + 0x2c]
mov qword [rdi + 0x1030], rax
mov rax, qword [rsp + 0x34]
mov qword [rdi + 0x1038], rax
call fcn.140008848
lea rcx, [rdi + 0x1018]
lea rdx, [rsp + 0x24]
call fcn.140008848
lea rcx, [rdi + 0x1020]
lea rdx, [rsp + 0x2c]
call fcn.140008848
and dword [rdi + 0x1040], 0
mov rax, rbx
mov rcx, qword [rsp + 0x1270]
xor rcx, rsp
call fcn.14000a670
mov rbx, qword [rsp + 0x12b8]
add rsp, 0x1280
pop r12
pop rdi
pop rsi
ret