joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086680
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x820
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x420]
mov r8d, 0x400
call fcn.14014d290
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call fcn.14014d290
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_GetParent]
xor edx, edx
lea rcx, [rsp + 0x848]
mov qword [rsp + 0x848], rax
call fcn.14001da60
xor ebp, ebp
lea rdi, [rbx + 0xa8]
cmp qword [rbx + 0xb8], rbp
jne 0x140086721
test rdi, rdi
mov rcx, rbx
mov edx, 0x10b
cmove rcx, rbp
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
lea rcx, [rbx + 0xb0]
call fcn.140018650
cmp qword [rbx + 0x100], rbp
jne 0x140086752
test rdi, rdi
mov rcx, rbx
mov edx, 0x10c
cmove rcx, rbp
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
lea rcx, [rbx + 0xf8]
call fcn.140018650
cmp qword [rbx + 0x148], rbp
jne 0x140086783
test rdi, rdi
mov rcx, rbx
mov edx, reloc.OLEAUT32.dll_VarUI4FromDisp
cmove rcx, rbp
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
lea rcx, [rbx + 0x140]
call fcn.140018650
cmp qword [rbx + 0x190], rbp
jne 0x1400867b4
test rdi, rdi
mov rcx, rbx
mov edx, 0x116
cmove rcx, rbp
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
lea rcx, [rbx + 0x188]
call fcn.140018650
mov rdi, qword [rbx + 8]
test rdi, rdi
je 0x14008680e
lea rcx, [0x1401f25f0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x1401f25e8]
cmp edx, dword [0x1401f25d8]
jae 0x140086801
mov r8d, dword [0x1401f25e0]
mov rax, qword [0x1401f25d0]
imul r8d, edx
mov rcx, qword [r8 + rax]
test rcx, rcx
je 0x140086801
mov r8d, 5
mov rdx, rdi
call fcn.14006d840
lea rcx, [0x1401f25f0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0xb8]
lea rdx, [rsp + 0x20]
mov r8d, 0x200
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r9, qword [rbx + 0xa8]
lea r8, [rsp + 0x20]
add r9, 0x85c
lea rcx, [rsp + 0x420]
mov edx, 0x200
call fcn.14001b5c0
mov rcx, qword [rbx + 0xb8]
lea rdx, [rsp + 0x420]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbx + 0x100]
lea rdx, [rsp + 0x20]
mov r8d, 0x200
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r9, qword [rbx + 0xa8]
lea r8, [rsp + 0x20]
add r9, 0x85c
lea rcx, [rsp + 0x420]
mov edx, 0x200
call fcn.14001b5c0
mov rcx, qword [rbx + 0x100]
lea rdx, [rsp + 0x420]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, qword [0x1401f23a8]
mov rcx, qword [rbx + 0x148]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbx + 0x190]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf1
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11, [rsp + 0x820]
mov eax, 1
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14008bad0
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rbx, rdx
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
lea r14, [0x1401b66b8]
mov qword [rbp - 9], r14
mov qword [rbp - 1], 0xffffffffffffffff
test rdx, rdx
je 0x14008bc45
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14008bb34
mov bl, 1
jmp 0x14008bc47
mov rcx, qword [rbp - 1]
cmp rcx, 0xffffffffffffffff
je 0x14008bb4c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 1], 0xffffffffffffffff
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rsi + 3]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 1], rax
cmp rax, 0xffffffffffffffff
je 0x14008bc45
mov ebx, esi
nop dword [rax + rax]
mov dword [rbp + 0x6f], esi
mov r8d, 0x40
sub r8d, ebx
mov eax, ebx
lea rdx, [rbp + 7]
add rdx, rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x6f]
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14008bbca
mov eax, dword [rbp + 0x6f]
test eax, eax
je 0x14008bbca
add ebx, eax
cmp ebx, 0x40
jb 0x14008bb90
mov eax, ebx
lock add qword [0x1401f3d70], rax
cmp ebx, 0x40
jne 0x14008bc45
movzx eax, word [rbp + 0x2b]
mov word [rbp + 0x6f], ax
movzx eax, word [rbp + 0x2d]
mov word [rbp + 0x71], ax
mov edx, dword [rbp + 0x6f]
mov rcx, qword [rbp - 1]
cmp rcx, 0xffffffffffffffff
je 0x14008bc45
mov qword [rbp + 0x6f], rdx
xor r9d, r9d
lea r8, [rbp + 0x73]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x6f], eax
cmp eax, 0xffffffff
jne 0x14008bc19
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14008bc45
cmp qword [rbp + 0x6f], 0xffffffffffffffff
je 0x14008bc45
lea rbx, [rdi + 0x18]
lea rdx, [rbp - 9]
mov rcx, rdi
call fcn.14001f860
test al, al
je 0x14008bc3d
lea rbx, [rdi + 0x18]
cmp dword [rbx], 1
jne 0x14008bc24
cmp dword [rbx], 1
sete bl
jmp 0x14008bc47
xor bl, bl
mov qword [rbp - 9], r14
mov rcx, qword [rbp - 1]
cmp rcx, 0xffffffffffffffff
je 0x14008bc5b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14008ce40
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x450
mov rdi, rcx
xor eax, eax
lea rcx, [rsp + 0x242]
mov word [rsp + 0x240], ax
xor edx, edx
mov r8d, 0x206
call fcn.14014d290
cmp qword [rdi + 0x238], 0x400
jb 0x14008d04b
xor r9d, r9d
lea rax, [rsp + 0x240]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14008d04b
lea rax, [rsp + 0x240]
mov edx, 0x104
lea r9, str._sMetaQuotes
mov qword [rsp + 0x20], rax
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
call fcn.140003a90
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
and cl, 0x13
cmp cl, 0x10
je 0x14008cf02
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008e510
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14008cf14
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rax, [rsp + 0x240]
mov edx, 0x104
lea r9, str._sMetaQuotesWebInstall
mov qword [rsp + 0x20], rax
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
call fcn.140003a90
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
and cl, 0x13
cmp cl, 0x10
je 0x14008cf6a
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008e510
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14008cf7c
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rdi
lea r9, str._s_S
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x240]
mov r8, 0xffffffffffffffff
call fcn.140003a90
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x240]
lea rcx, [rdi + 0x230]
call fcn.1400041e0
test al, al
jne 0x14008d047
cmp word [rdi + 0x20], 0
lea rbx, [rdi + 0x20]
je 0x14008d04b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
cmp eax, 0xffffffff
jne 0x14008cff7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x14008d002
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x28], rdi
lea r9, str._s_S
mov edx, 0x104
mov qword [rsp + 0x20], rbx
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x240]
call fcn.140003a90
lea rdx, [rsp + 0x240]
lea rcx, [rdi + 0x230]
call fcn.1400041e0
test al, al
setne al
jmp 0x14008d04d
mov al, 1
jmp 0x14008d04d
xor al, al
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14008e510
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
test rcx, rcx
je 0x14008e696
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x490
mov edi, edx
mov rbx, rcx
cmp word [rcx], 0
je 0x14008e682
cmp edx, 0xf
jg 0x14008e682
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x240]
call fcn.14014d290
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor eax, eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0x104
mov word [rsp + 0x38], ax
lea rax, [0x1401b6698]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, str._s.
lea rcx, [rsp + 0x20]
call fcn.140003670
lea rdx, [rsp + 0x240]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14008e682
lea r9, [rsp + 0x26c]
mov r8, rbx
lea rdx, [0x1401bff50]
lea rcx, [rsp + 0x20]
call fcn.140003670
mov ecx, dword [rsp + 0x240]
test cl, 0x10
je 0x14008e63f
movzx edx, word [rsp + 0x26c]
movzx eax, word [rsp + 0x26e]
cmp dx, 0x2e
jne 0x14008e60d
test ax, ax
je 0x14008e65f
cmp dx, dx
jne 0x14008e60d
cmp ax, dx
jne 0x14008e60d
cmp word [rsp + 0x270], 0
je 0x14008e65f
test cl, 1
je 0x14008e622
mov edx, 0x80
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [rdi + 1]
xor r8d, r8d
mov rcx, qword [rsp + 0x28]
call fcn.14008e510
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14008e65f
test cl, 1
je 0x14008e654
mov edx, 0x80
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x240]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14008e5b5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14008fed0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor eax, eax
mov r14, r8
mov qword [rsp + 0x30], rax
mov r15, rdx
mov dword [rsp + 0x38], eax
mov rsi, rcx
test r8, r8
je 0x14009007f
xor ebp, ebp
mov word [r8], bp
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
jne 0x14008ff14
jmp 0x14008ff56
mov eax, dword [rdx]
lea r8, [rsp + 0x84]
mov edx, eax
mov qword [rsp + 0x80], rax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x80], eax
cmp eax, 0xffffffff
jne 0x14008ff4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, 0xffffffffffffffff
test eax, eax
jne 0x14008ff56
mov rcx, qword [rsp + 0x80]
mov eax, dword [r15]
cmp rcx, rax
jne 0x14009007f
cmp qword [rsi + 8], 0xffffffffffffffff
je 0x14009007f
mov ebx, ebp
nop
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x30]
mov r8d, recv
mov eax, ebx
sub r8d, ebx
mov dword [rsp + 0x88], ebp
add rdx, rax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14008ffb7
mov eax, dword [rsp + 0x88]
test eax, eax
je 0x14008ffb7
add ebx, eax
cmp ebx, 0xc
jb 0x14008ff70
mov eax, ebx
lock add qword [0x1401f3d70], rax
cmp ebx, 0xc
jne 0x14009007f
mov ebx, dword [r15 + 4]
mov ecx, dword [rsp + 0x30]
cmp ecx, ebx
je 0x14009007f
sub ebx, ecx
cmp ebx, 7
jbe 0x14009007f
mov edi, ebx
cmp rdi, 0xffe
jae 0x14009007f
mov edx, dword [r15]
xor r8d, r8d
add edx, ecx
mov rcx, rsi
call fcn.140004130
mov ecx, dword [r15]
add ecx, dword [rsp + 0x30]
cmp rax, rcx
jne 0x14009007f
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call fcn.14000c3b0
cmp eax, ebx
jne 0x14009007f
xor dl, dl
lea r11, [0x1401bd1e0]
mov r8, r14
mov r9, rbp
mov r10d, edi
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
mov rax, r9
inc r9
and eax, 0xf
add dl, byte [r11 + rax*4]
xor dl, cl
mov byte [r8 - 1], dl
movzx edx, cl
sub r10, 1
jne 0x140090040
shr rdi, 1
mov al, 1
mov word [r14 + rdi*2], bp
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x70]
xor al, al
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140090600
Capabilities:
Get file size
Read file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
push rdi
push r14
sub rsp, 0x268
mov r14, r8
mov rdi, rcx
test rdx, rdx
je 0x140090888
test r8, r8
je 0x140090888
mov qword [rsp + 0x20], rdx
lea r9, str._s:Zone.Identifier:_DATA
mov qword [rsp + 0x250], r15
lea rcx, [rsp + 0x40]
xor r15d, r15d
mov edx, 0x103
mov word [r8], r15w
lea r8, [r15 - 1]
call fcn.140003a90
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
je 0x14009066d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], 0xffffffffffffffff
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x280], rbx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov qword [rsp + 0x260], rbp
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x14009085e
lea rdx, [rsp + 0x288]
mov qword [rsp + 0x258], rsi
mov rcx, rax
mov qword [rsp + 0x288], r15
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14009083e
mov rsi, qword [rsp + 0x288]
test rsi, rsi
je 0x14009083e
lea rcx, [rsi + 0x10]
lea rdx, [0x14014fdc0]
call fcn.14002e8b0
mov rbp, rax
test rax, rax
je 0x14009083e
cmp qword [rdi + 8], 0xffffffffffffffff
je 0x140090781
mov rbx, r15
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [rbx + rbp]
mov r8d, 0xfffffff
mov dword [rsp + 0x298], r15d
mov rax, rsi
mov qword [rsp + 0x20], r15
sub rax, rbx
lea r9, [rsp + 0x298]
cmp rax, r8
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14009076d
mov eax, dword [rsp + 0x298]
test eax, eax
je 0x14009076d
add rbx, rax
cmp rbx, rsi
jb 0x140090720
lock add qword [0x1401f3d70], rbx
cmp rbx, rsi
jne 0x140090781
mov word [rsi + rbp], r15w
jmp 0x14009078c
mov rcx, rbp
call fcn.14002e8a8
mov rbp, r15
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400907a4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], 0xffffffffffffffff
test rbp, rbp
je 0x140090856
lea rdx, str.HostUrl
mov rcx, rbp
call fcn.140030ac8
mov rbx, rax
test rax, rax
je 0x140090834
add rbx, 8
lea rdx, [0x1401c7814]
mov rcx, rbx
call fcn.140030ac8
test rax, rax
je 0x1400907df
mov byte [rax], r15b
lea rdx, [0x1401c7818]
mov rcx, rbx
call fcn.140030ac8
test rax, rax
je 0x1400907f6
mov byte [rax], r15b
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rbx + rax], r15b
jne 0x140090800
cmp rax, 0x103
jae 0x140090834
mov dword [rsp + 0x28], 0x103
mov r9d, 0xffffffff
mov r8, rbx
mov qword [rsp + 0x20], r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbp
call fcn.14002e8a8
jmp 0x140090856
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
je 0x140090856
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], 0xffffffffffffffff
mov rsi, qword [rsp + 0x258]
cmp word [r14], r15w
mov r15, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x260]
setne al
mov rbx, qword [rsp + 0x280]
add rsp, 0x268
pop r14
pop rdi
ret
xor al, al
add rsp, 0x268
pop r14
pop rdi
ret
Function at 0x1400920e0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push rbp
push rsi
sub rsp, 0x498
mov rbp, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
xor esi, esi
call fcn.14014d290
test rbp, rbp
je 0x14009236a
mov qword [rsp + 0x4b8], rdi
lea r9, [0x1401bff50]
mov qword [rsp + 0x4c0], r14
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x490], r15
mov rdi, 0xffffffffffffffff
lea r15, [0x1401bff40]
mov qword [rsp + 0x4b0], rbx
mov qword [rsp + 0x28], r15
mov r8, rdi
mov edx, 0x104
mov qword [rsp + 0x20], rbp
call fcn.140003a90
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, rdi
je 0x1400922d7
nop word [rax + rax]
test byte [rsp + 0x240], 0x10
je 0x140092216
lea rdx, [0x1401b98f4]
lea rcx, [rsp + 0x26c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400922b5
lea rdx, [0x1401bff48]
lea rcx, [rsp + 0x26c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400922b5
lea rax, [rsp + 0x26c]
mov r8, rdi
mov qword [rsp + 0x28], rax
lea r9, [0x1401bff50]
mov edx, 0x104
mov qword [rsp + 0x20], rbp
lea rcx, [rsp + 0x30]
call fcn.140003a90
mov r9b, 1
mov byte [rsp + 0x20], 1
mov r8, r15
lea rdx, [rsp + 0x30]
lea rcx, [0x14021ad58]
call fcn.1400920e0
add esi, eax
jmp 0x1400922b5
lea rax, [rsp + 0x26c]
mov r8, rdi
mov qword [rsp + 0x28], rax
lea r9, [0x1401bff50]
mov edx, 0x104
mov qword [rsp + 0x20], rbp
lea rcx, [rsp + 0x30]
call fcn.140003a90
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400922b3
lea rcx, [rsp + 0x30]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140092260
cmp eax, dword [0x1401f23b0]
jae 0x1400922b3
mov rbx, qword [0x1401f23a8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
lea rdx, [rsp + 0x30]
add r8, r8
mov rcx, rbx
call fcn.14014d630
test eax, eax
je 0x1400922b3
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x14021ad58], 1
inc esi
lea rdx, [rsp + 0x240]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140092180
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov r15, qword [rsp + 0x490]
mov r14, qword [rsp + 0x4c0]
test eax, eax
je 0x140092300
inc esi
jmp 0x14009234e
inc rdi
cmp word [rbp + rdi*2], 0
jne 0x140092300
cmp edi, dword [0x1401f23b0]
jae 0x14009234e
mov rbx, qword [0x1401f23a8]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
mov rdx, rbp
add r8, r8
mov rcx, rbx
call fcn.14014d630
test eax, eax
je 0x14009234e
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x14021ad58], 1
mov rdi, qword [rsp + 0x4b8]
mov eax, esi
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x498
pop rsi
pop rbp
ret
xor eax, eax
add rsp, 0x498
pop rsi
pop rbp
ret
Function at 0x140092660
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rbp
push r14
sub rsp, 0x670
mov rbp, r9
mov rbx, r8
test r8, r8
je 0x140092838
test r9, r9
je 0x140092838
xor r14d, r14d
lea r8, [rax + 0x18]
xor ecx, ecx
mov qword [rax + 0x18], r14
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x140092838
cmp qword [rsp + 0x6a0], r14
je 0x140092838
xor edx, edx
mov qword [rsp + 0x698], rdi
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.14014d290
mov rcx, qword [rsp + 0x6a0]
lea rdx, [rsp + 0x40]
xor dil, dil
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x140092812
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rbp
lea r9, str._s_s.lnk
mov qword [rsp + 0x20], rax
mov edx, 0x103
lea r8, [r14 - 1]
lea rcx, [rsp + 0x250]
call fcn.140003a90
lea rax, [rsp + 0x690]
mov qword [rsp + 0x690], r14
lea r9, [0x14014fd80]
mov qword [rsp + 0x20], rax
xor edx, edx
lea r8d, [r14 + 1]
lea rcx, [0x14014fda0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140092812
mov rcx, qword [rsp + 0x690]
test rcx, rcx
je 0x140092812
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
lea rdx, [0x14014fdb0]
call qword [rax]
test eax, eax
js 0x1400927e7
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400927e7
mov rax, qword [rcx]
lea rdx, [rsp + 0x250]
xor r8d, r8d
call qword [rax + 0x28]
test eax, eax
js 0x1400927dc
mov rcx, qword [rsp + 0x690]
lea rdx, [rsp + 0x460]
mov r8d, 0x103
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x1400927dc
lea rdx, [rsp + 0x460]
sub rdx, rbx
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x1400927d6
add rbx, 2
test eax, eax
jne 0x1400927c3
test ecx, ecx
sete dil
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x690]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test dil, dil
je 0x140092812
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
movzx edi, dil
cmove edi, r14d
mov rcx, qword [rsp + 0x6a0]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, dil
mov rdi, qword [rsp + 0x698]
add rsp, 0x670
pop r14
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x670
pop r14
pop rbp
pop rbx
ret
Function at 0x140092850
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 8], rcx
push rsi
push r14
push r15
sub rsp, 0x250
mov rsi, r9
mov r14, r8
mov r15d, edx
test r8, r8
je 0x14009297d
test r9, r9
je 0x14009297d
cmp qword [rsp + 0x298], 0
je 0x14009297d
mov ebp, dword [rsp + 0x2a0]
test ebp, ebp
je 0x14009297d
mov rbx, qword [rsp + 0x2a8]
test rbx, rbx
je 0x14009297d
xor edx, edx
mov qword [rax + 8], 0
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.14014d290
lea r8, [rsp + 0x270]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x14009297d
mov rcx, qword [rsp + 0x270]
test rcx, rcx
je 0x14009297d
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x270]
test eax, eax
je 0x140092977
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsp + 0x290]
lea edx, [rbp - 1]
mov rcx, qword [rsp + 0x298]
lea r9, str._s_s.lnk
mov qword [rsp + 0x28], rax
mov r8, 0xffffffffffffffff
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140003a90
cmp word [rbx], 0
mov r8, rsi
mov r9, qword [rsp + 0x298]
mov rdx, r14
cmove rbx, rsi
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], rbx
call fcn.140092fd0
jmp 0x14009297f
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rsi
ret