joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bec8
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x100
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, rcx
mov ecx, 0x7d0
call fcn.1400144dc
lea rsi, str.javaw.exe
mov rcx, rsi
mov r13, rax
call fcn.140014610
mov rbx, rdi
mov rcx, rdi
sub rbx, rax
call fcn.140014610
mov rdx, rsi
lea rcx, [rbx + rax]
call fcn.1400165b0
mov rcx, rsi
test eax, eax
je 0x14000bf3a
lea rcx, str.java.exe
call fcn.140014610
or ebx, 0xffffffff
mov rcx, rdi
sub ebx, eax
call fcn.140014610
mov rdx, rdi
add eax, ebx
mov rcx, r13
movsxd rbx, eax
mov r8, rbx
call fcn.1400149c0
mov rcx, r13
mov byte [rbx + r13], 0
call fcn.140012f88
mov ebx, 0x5dc0
mov rcx, rbx
mov r14, rax
call fcn.1400144dc
mov rcx, rbx
mov r12, rax
call fcn.1400144dc
lea rcx, str.PATH
mov rdx, rax
mov r8d, 0x2ee0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rdx, rdi
mov rcx, r12
call fcn.140014be0
lea rdx, [0x1400301ec]
mov rcx, r12
call fcn.140014b40
mov rdx, r13
mov rcx, r12
call fcn.140014b40
lea rcx, str.PATH
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x14000bfea
lea rcx, str.Setting_PATH__S
mov rdx, r12
call fcn.1400104ac
jmp 0x14000c002
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Setting_PATH__S_failed_with_error__d
mov rdx, r12
mov r8d, eax
call fcn.1400104ac
mov ecx, 0x5dc6
call fcn.1400144dc
lea rdx, str.PATH_s
mov r8, r12
mov rcx, rax
mov rsi, rax
call fcn.140015a38
mov rcx, rsi
call fcn.140018330
mov r8d, 0xc8
lea rdx, [rsp + 0x20]
lea ecx, [r8 - 0x30]
xor ebx, ebx
call fcn.140004500
lea rcx, [rsp + 0x20]
call fcn.140014610
test rax, rax
je 0x14000c05e
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.14000be10
mov rbx, rax
lea rbp, str.hotspot
test rbx, rbx
jne 0x14000c0f1
mov rdx, qword [rbp]
mov rcx, r13
call fcn.14000be10
add rbp, 8
mov rbx, rax
lea rax, str.i4j_jres
cmp rbp, rax
jl 0x14000c065
test rbx, rbx
jne 0x14000c0f1
mov rcx, r14
call fcn.140013064
lea rcx, str.PATH
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x14000c0bf
lea rcx, str.Setting_PATH__S
mov rdx, rdi
call fcn.1400104ac
jmp 0x14000c0d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Setting_PATH__S_failed_with_error__d
mov rdx, rdi
mov r8d, eax
call fcn.1400104ac
lea rdx, str.PATH_s
mov r8, rdi
mov rcx, rsi
call fcn.140015a38
mov rcx, rsi
call fcn.140018330
mov rcx, r12
call fcn.1400149a0
mov rcx, rdi
call fcn.1400149a0
mov rcx, rsi
call fcn.1400149a0
mov rcx, r13
call fcn.1400149a0
mov rax, rbx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140014d30
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14000e0ec
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x46b8
call fcn.14002d9b0
sub rsp, rax
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0x46a0], rax
mov r12, qword [rsp + 0x4710]
mov r13, qword [rsp + 0x4718]
mov ebx, edx
mov rdi, r8
mov rsi, rcx
lea rdx, [rsp + 0x50]
mov r8d, 0x1770
mov ecx, 0xa0
mov rbp, r9
call fcn.140004500
lea rdx, [rsp + 0x50]
lea rcx, str.checking_app_id__S___d___p_
mov r9, rsi
mov r8d, ebx
call fcn.1400104ac
lea rcx, [rsp + 0x50]
call fcn.140014610
test rax, rax
je 0x14000e2c5
lea rax, [rsp + 0x38]
or ebx, 0x20019
lea rdx, str.SOFTWAREej_technologiesinstall4jinstallations
xor r8d, r8d
mov rcx, rsi
mov r9d, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000e2b7
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f30]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x30], 0x1770
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000e29c
cmp dword [rsp + 0x30], eax
jbe 0x14000e29c
lea rdx, [rsp + 0x2f30]
lea rcx, str.found_installations:__S
call fcn.1400104ac
lea rcx, [rsp + 0x2f30]
lea rdx, [0x1400301ec]
call fcn.14001587c
mov rbx, rax
test rax, rax
je 0x14000e2aa
mov rcx, rax
call fcn.140014610
test rax, rax
je 0x14000e2aa
lea rdx, str._sjre
lea rcx, [rsp + 0x17c0]
mov r8, rbx
call fcn.140015a38
lea rdx, [rsp + 0x17c0]
mov rcx, rdi
call fcn.14000b650
test al, al
je 0x14000e27d
mov r9, r13
mov r8, r12
mov rdx, rbp
mov rcx, rdi
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
call fcn.14000df20
test al, al
jne 0x14000e298
lea rcx, str.java_version_did_not_match_in__S
jmp 0x14000e284
lea rcx, str.did_not_find_java_in__S
lea rdx, [rsp + 0x17c0]
call fcn.1400104ac
xor ecx, ecx
jmp 0x14000e201
mov al, 1
jmp 0x14000e2c7
lea rcx, str.could_not_query_value_node__d
xor edx, edx
call fcn.1400104ac
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000e2c5
lea rcx, str.could_not_open_installation_node__d
mov edx, eax
call fcn.1400104ac
xor al, al
mov rcx, qword [rsp + 0x46a0]
xor rcx, rsp
call fcn.140014d30
add rsp, 0x46b8
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e560
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x17b0
call fcn.14002d9b0
sub rsp, rax
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0x17a0], rax
mov r14, qword [rsp + 0x1810]
mov rax, r8
mov r12, rdx
mov rbp, rcx
lea rdx, [rsp + 0x30]
mov r8d, 0x1770
mov rcx, rax
mov r13, r9
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14000e623
lea rcx, [rsp + 0x30]
xor esi, esi
call fcn.140014610
lea ebx, [rsi + 1]
test rax, rax
je 0x14000e5ee
lea rdi, [rsp + 0x30]
cmp byte [rdi], 0x2f
jne 0x14000e5d7
mov byte [rdi], 0x5c
lea rcx, [rsp + 0x30]
add esi, ebx
add rdi, rbx
call fcn.140014610
movsxd rcx, esi
cmp rcx, rax
jb 0x14000e5cf
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.14000b650
test al, al
je 0x14000e61d
mov r9, r14
mov r8, r13
mov rdx, r12
mov rcx, rbp
mov byte [rsp + 0x28], bl
mov byte [rsp + 0x20], 0
call fcn.14000df20
test al, al
jne 0x14000e61f
xor ebx, ebx
mov al, bl
jmp 0x14000e625
xor al, al
mov rcx, qword [rsp + 0x17a0]
xor rcx, rsp
call fcn.140014d30
add rsp, 0x17b0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000edac
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r15, rdx
lea rax, [r11 - 0x50]
mov r12, r8
xor bpl, bpl
lea rdx, str.SOFTWAREej_technologiesexe4jlocatedjvms_
mov r9d, 0x20019
mov byte [r8], bpl
xor r8d, r8d
mov qword [r11 - 0x78], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000ef8d
mov edi, 0x1770
mov rcx, rdi
mov dword [rsp + 0xb0], edi
mov dword [rsp + 0x40], edi
call fcn.1400144dc
mov rcx, rdi
mov r13, rax
call fcn.1400144dc
mov rcx, rdi
mov rsi, rax
call fcn.1400144dc
mov rcx, rdi
mov rbx, rax
call fcn.1400144dc
xor r14d, r14d
mov rdi, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
and qword [rsp + 0x20], r14
xor edx, edx
jmp 0x14000ef44
mov byte [rbx], 0
mov rcx, rsi
mov byte [rdi], 0
call fcn.140014610
inc eax
movsxd r8, eax
test eax, eax
jle 0x14000ee9a
mov rdx, rsi
mov rcx, rbx
sub rdx, rbx
movzx eax, byte [rdx + rcx]
mov r9d, 0x5c
cmp al, 0x2f
cmove eax, r9d
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x14000ee7f
cmp byte [rsp + 0xc8], 0
jne 0x14000eeb8
lea rdx, str.i4j_jres
mov rcx, rbx
call fcn.140016e70
test rax, rax
je 0x14000ef09
mov r9, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xb8]
mov rdx, rdi
mov rcx, rbx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
call fcn.14000df20
test al, al
je 0x14000ef09
mov rdx, r12
mov rcx, rdi
call fcn.14000dc90
test al, al
je 0x14000ef09
mov rdx, rdi
mov rcx, r12
call fcn.140014be0
mov rdx, rbx
mov rcx, r15
call fcn.140014be0
mov bpl, 1
lea rax, [rsp + 0x50]
inc r14d
mov dword [rsp + 0xb0], 0x1770
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb0]
mov dword [rsp + 0x40], 0x1770
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
and qword [rsp + 0x20], 0
mov edx, r14d
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x14000ee5f
mov rcx, rbx
call fcn.1400149a0
mov rcx, rdi
call fcn.1400149a0
mov rcx, r13
call fcn.1400149a0
mov rcx, rsi
call fcn.1400149a0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bpl
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000fad8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r10, rdx
test r8d, r8d
jle 0x14000fb0c
mov r9d, r8d
mov r8d, dword [rcx]
movsx eax, byte [r10]
inc r10
xor rax, r8
shr r8d, 8
movzx edx, al
lea rax, [0x14003b120]
mov eax, dword [rax + rdx*4]
xor eax, r8d
sub r9, 1
mov dword [rcx], eax
jne 0x14000fae3
repz ret

Function at 0x14000fed4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140014610
cmp eax, 3
jl 0x14000ffcb
cmp byte [rbx + 1], 0x2d
jne 0x14000ffcb
mov rcx, qword [0x14003b118]
lea rdi, [0x14003b118]
jmp 0x14000ff68
mov rsi, qword [rdi]
mov rcx, rsi
call fcn.140014610
mov rbp, rax
lea ecx, [rax + 1]
movsxd rcx, ecx
call fcn.1400144dc
test ebp, ebp
jle 0x14000ff4a
movsxd r8, ebp
mov rdx, rax
sub rsi, rax
mov cl, byte [rsi + rdx]
xor cl, 0xbb
mov byte [rdx], cl
inc rdx
sub r8, 1
jne 0x14000ff39
movsxd r8, ebp
mov rdx, rax
mov rcx, rbx
mov byte [r8 + rax], 0
call fcn.140015980
test eax, eax
je 0x14000ffcb
add rdi, 8
mov rcx, qword [rdi]
call fcn.140014610
test rax, rax
jne 0x14000ff13
movsx ecx, byte [rbx]
sub ecx, 0x41
je 0x14000ffa7
sub ecx, 4
je 0x14000ff9b
sub ecx, 7
je 0x14000ffa7
sub ecx, 7
je 0x14000ffa7
cmp ecx, 1
jne 0x14000ffcb
mov rcx, rbx
call fcn.14000f93c
add eax, 0xfffffffc
jmp 0x14000ffb2
mov dl, 1
mov rcx, rbx
call fcn.14000fe44
jmp 0x14000ffd0
mov rcx, rbx
call fcn.14000f93c
add eax, 0xfffffffe
cmp eax, 1
ja 0x14000ffcb
mov rcx, rbx
call fcn.14000fd80
neg al
sbb eax, eax
and eax, 2
add eax, 0xfffffffd
jmp 0x14000ffd0
mov eax, 0xfffffffd
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001052c
Capabilities:
Set registry value

Disassembly:
mov eax, 0x17e8
call fcn.14002d9b0
sub rsp, rax
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0x17d0], rax
call fcn.140005bf8
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov rdx, rax
call fcn.140006a04
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, str.SOFTWAREej_technologiesexe4jpids_
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400105de
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x58]
mov r9d, 4
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x17d0]
xor rcx, rsp
call fcn.140014d30
add rsp, 0x17e8
ret

Function at 0x1400105f8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
mov eax, 0x17d0
call fcn.14002d9b0
sub rsp, rax
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0x17c0], rax
call fcn.140005bf8
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov rdx, rax
call fcn.140006a04
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREej_technologiesexe4jpids_
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1400106a8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x14001069d
cmp dword [rsp + 0x30], 4
cmove ebx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x17c0]
xor rcx, rsp
call fcn.140014d30
add rsp, 0x17d0
pop rbx
ret
Function at 0x140010a10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
call fcn.140010718
mov rcx, rbx
mov rsi, rax
call fcn.140015088
lea rbp, str.__i4j_empty_command_line
test rax, rax
mov edx, 0x40000000
mov rcx, rsi
cmovne rbp, rbx
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor ebx, ebx
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140010adf
mov ecx, ebx
inc ebx
cmp ecx, 0x32
jge 0x140010ac3
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140010a7b
cmp rdi, 0xffffffffffffffff
jne 0x140010adf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_mailslot_CreateFile__d
mov edx, eax
call fcn.1400104ac
jmp 0x140010b40
mov rcx, rbp
call fcn.140015088
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov rbx, rax
mov rdx, rbp
mov rcx, rdi
add ebx, ebx
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140010b20
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_mailslot_WriteFile__d
mov edx, eax
call fcn.1400104ac
jmp 0x140010b37
mov edx, dword [rsp + 0x60]
cmp edx, ebx
je 0x140010b37
lea rcx, str.error_mailslot_WriteFile_length__d__d
mov r8d, ebx
call fcn.1400104ac
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
jmp fcn.1400149a0
Function at 0x140010ea4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
movss xmm0, dword [0x14003b938]
and dword [rax + 0x20], 0
and dword [rax - 0x38], 0
ucomiss xmm0, dword [0x140033460]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm7, xmm7
jp 0x140010f46
jne 0x140010f46
movss xmm6, dword [0x14003345c]
lea rcx, str.J2D_UISCALE
movss dword [0x14003b938], xmm6
call fcn.140017d94
test rax, rax
je 0x140010f3e
xor edx, edx
mov rcx, rax
call fcn.140018c28
cvtsd2ss xmm1, xmm0
movss dword [0x14003b938], xmm1
call fcn.140018a1c
cmp dword [rax], 0x22
je 0x140010f31
movss xmm0, dword [0x14003b938]
comiss xmm7, xmm0
jb 0x140010f46
movaps xmm0, xmm6
movss dword [0x14003b938], xmm0
jmp 0x140010f46
movss xmm0, dword [0x14003b938]
comiss xmm0, xmm7
jbe 0x140010f58
movss dword [rbx], xmm0
movss dword [rdi], xmm0
jmp 0x140011045
cmp qword [0x140048fa0], 0
jne 0x140010f94
lea rcx, str.shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140048fa0], rax
test rax, rax
je 0x140010f94
lea rdx, str.GetDpiForMonitor
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140048f98], rax
jmp 0x140010f9b
mov rax, qword [0x140048f98]
test rax, rax
je 0x140010fdd
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x78]
xor edx, edx
mov rcx, rsi
call rax
test eax, eax
jne 0x140011045
mov eax, dword [rsp + 0x78]
pxor xmm0, xmm0
pxor xmm1, xmm1
cvtsi2ss xmm0, rax
mov eax, dword [rsp + 0x20]
cvtsi2ss xmm1, rax
movss dword [rdi], xmm0
movss dword [rbx], xmm1
jmp 0x140011045
lea rcx, str.D2d1.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140048f90], rax
test rax, rax
je 0x140011045
lea rdx, [0x140033400]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140048f88], rax
test rax, rax
je 0x140011045
lea r9, [rsp + 0x28]
lea rdx, [0x1400333f0]
xor r8d, r8d
xor ecx, ecx
call rax
test eax, eax
jne 0x140011045
mov rcx, qword [rsp + 0x28]
mov r8, rbx
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rdi
ret
Function at 0x140012cdc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rbx
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140012d2a
call fcn.140014610
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8, rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x140012d3d
call fcn.140018c30
call fcn.140016020
lea rcx, [rax + 0x30]
call fcn.140015e58
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140012d94
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x140012e1f
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x94
call fcn.1400169c0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x24], 6
jne 0x140012df7
cmp dword [rsp + 0x28], 0
je 0x140012e1f
lea rdx, str.SetDefaultDllDirectories
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140012e1f
mov ecx, 0xc00
call rax
lea rcx, str.restrict_DLL_directories
call fcn.1400104ac
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140014d30
add rsp, 0xd0
pop rbx
ret

Function at 0x140012e38
Capabilities:
Create directory

Disassembly:
push rbx
mov eax, 0x17a0
call fcn.14002d9b0
sub rsp, rax
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0x1790], rax
xor ebx, ebx
lea rcx, [rsp + 0x20]
call fcn.1400066e4
xor ecx, ecx
call fcn.140016514
lea r8, [rsp + 0x20]
lea rdx, str._s_dir_d
lea rcx, [0x140048fb0]
mov r9, rax
call fcn.140015a38
lea rdx, [0x140048fb0]
lea rcx, str.Temp_dir3:__S
call fcn.1400104ac
lea rcx, [0x140048fb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140012ee0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140033e68]
mov edx, eax
call fcn.1400104ac
inc ebx
cmp ebx, 0xa
jl 0x140012e5b
lea rdx, [0x140033e64]
mov ecx, 0x3f1
mov byte [0x140048fb0], 0
call fcn.140004f50
mov rcx, qword [rsp + 0x1790]
xor rcx, rsp
call fcn.140014d30
add rsp, 0x17a0
pop rbx
ret

Function at 0x140012efc
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x48
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov rcx, rax
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140012f82
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140012f82
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
add rsp, 0x48
ret
Function at 0x1400130e4
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, 0xbb80
mov rcx, rbx
call fcn.1400144dc
mov ecx, 0x2ee0
mov rdi, rax
call fcn.1400144dc
mov r8d, 0x1770
mov rdx, rax
mov ecx, 0x2714
mov rsi, rax
call fcn.140004500
lea rcx, str.native_lib_dir_is__S
mov rdx, rsi
call fcn.1400104ac
mov rcx, rsi
call fcn.140008958
lea r8, [0x1400130bc]
mov rdx, rsi
mov rcx, rdi
call fcn.140006bb4
mov rcx, rdi
call fcn.140014610
test rax, rax
je 0x140013177
mov rcx, rdi
call fcn.140014610
cmp byte [rax + rdi - 1], 0x3b
je 0x140013177
lea rdx, [0x1400301ec]
mov rcx, rdi
call fcn.140014b40
mov rcx, rdi
call fcn.140014610
mov rcx, rdi
sub ebx, eax
call fcn.140014610
lea rcx, str.PATH
lea rdx, [rdi + rax]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rcx, str.PATH
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x1400131c2
lea rcx, str.Setting_PATH__native_libs___S
mov rdx, rdi
call fcn.1400104ac
jmp 0x1400131da
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Setting_PATH__native_libs___S_failed_with_error__d
mov rdx, rdi
mov r8d, eax
call fcn.1400104ac
mov rcx, rdi
call fcn.140014610
lea rcx, [rax + 6]
call fcn.1400144dc
lea rdx, str.PATH_s
mov r8, rdi
mov rcx, rax
mov rbx, rax
call fcn.140015a38
mov rcx, rbx
call fcn.140018330
mov rcx, rbx
call fcn.1400149a0
mov rcx, rdi
call fcn.1400149a0
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400149a0
Function at 0x140013fec
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x4740
call fcn.14002d9b0
sub rsp, rax
mov rax, qword [0x14003b9c0]
xor rax, rsp
mov qword [rsp + 0x4730], rax
mov rsi, rcx
lea rcx, [rsp + 0xe0]
mov rdi, rdx
call fcn.140014be0
lea rcx, str..pack
call fcn.140014610
lea rbx, [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
sub rbx, rax
call fcn.140014610
xor ebp, ebp
mov rcx, rdi
mov byte [rax + rbx], bpl
call fcn.140005b18
cmp al, bpl
jne 0x14001406e
lea rcx, str.pack_path_doesnt_exists
call fcn.1400104ac
jmp 0x1400141bf
lea rdx, str._s_binunpack200.exe
lea rcx, [rsp + 0x2fc0]
mov r8, rsi
call fcn.140015a38
lea r9, [rsp + 0xe0]
lea rdx, str._r___s____s_
lea rcx, [rsp + 0x1850]
mov r8, rdi
call fcn.140015a38
lea rdx, [rsp + 0x2fc0]
lea rcx, [0x140030058]
call fcn.1400104ac
lea rdx, [rsp + 0x1850]
lea rcx, [0x140030058]
call fcn.1400104ac
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call fcn.1400169c0
mov ebx, 0x68
lea rcx, [rsp + 0x70]
mov r8, rbx
xor edx, edx
call fcn.1400169c0
lea ecx, [rbx - 0x67]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x1850]
lea rcx, [rsp + 0x2fc0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x70], ebx
mov word [rsp + 0xb0], bp
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebp
jne 0x14001416d
lea rcx, str.could_not_create_unpack_process
call fcn.1400104ac
lea rdx, [0x140034560]
mov ecx, 0x3f1
call fcn.140004f50
lea rcx, str.waiting_for_unpack200_to_finish
call fcn.1400104ac
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.unpack_done
call fcn.1400104ac
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, ebp
jne 0x1400141bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400141bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.could_not_delete_packed_file__error__d_
mov edx, eax
call fcn.1400104ac
mov rcx, qword [rsp + 0x4730]
xor rcx, rsp
call fcn.140014d30
mov rbx, qword [rsp + 0x4770]
add rsp, 0x4740
pop rdi
pop rsi
pop rbp
ret