joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400dcfc0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0xe0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x20], r8
mov rsi, rcx
mov edi, edx
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
lea rcx, [0x140276430]
call fcn.140005a50
lea rcx, [0x140243758]
mov qword [rax + 8], rcx
mov qword [rbp - 0x48], rax
test dil, dil
je 0x1400dd0d4
xor ecx, ecx
mov dword [rbp - 0x50], ecx
test rsi, rsi
je 0x1400dd034
mov qword [rbp + 0x10], rsi
lea rcx, [rsi + 0xc]
jmp 0x1400dd03a
xor ecx, ecx
mov qword [rbp + 0x10], rsi
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x70], rcx
lea r8, [rbp - 0x50]
mov qword [rbp - 0x78], r8
mov edx, 0x20001009
mov dword [rbp - 0x64], edx
mov r9d, 4
mov dword [rbp - 0x68], r9d
lea rcx, [rbp - 0xa8]
call fcn.1400076d0
mov rcx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x78]
mov edx, dword [rbp - 0x64]
mov r9d, dword [rbp - 0x68]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0xa8]
call fcn.140007720
xor ecx, ecx
mov qword [rbp - 0x58], rcx
mov edx, dword [rbp - 0x50]
test edx, edx
je 0x1400dd0c5
mov dword [rbp - 0x40], edx
mov rcx, qword [rbp - 0x48]
inc dword [rcx + 0x14]
mov rax, qword [rcx + 8]
mov r8d, dword [rcx + 0x10]
mov r10d, dword [rax + 8]
cmp r10d, r8d
jbe 0x1400dd0cb
lea r10d, [r8 + 1]
mov dword [rcx + 0x10], r10d
mov ecx, r8d
mov dword [rax + rcx*4 + 0x10], edx
mov rsi, qword [rbp + 0x10]
jmp 0x1400dd0d4
mov rsi, qword [rbp + 0x10]
jmp 0x1400dd0d4
call fcn.140190810
mov rsi, qword [rbp + 0x10]
xor r9d, r9d
test rsi, rsi
je 0x1400dd0e2
add rsi, 0xc
jmp 0x1400dd0e4
xor esi, esi
mov qword [rbp - 0x60], rsi
mov rdx, rsi
mov dword [rsp + 0x20], 1
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x70], r9
lea rcx, [0x1400dc280]
mov qword [rbp - 0x80], rcx
mov r8d, 0xffffffff
mov dword [rbp - 0x68], r8d
lea rcx, [rbp - 0xa8]
call fcn.1400076d0
mov rdx, qword [rbp - 0x78]
mov r9, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x80]
mov r8d, dword [rbp - 0x68]
call sub.KERNEL32.dll_EnumCalendarInfoExEx
lea rcx, [rbp - 0xa8]
call fcn.140007720
xor eax, eax
mov qword [rbp - 0x60], rax
mov rbx, qword [rbp + 0x20]
mov ecx, dword [rbx + 8]
jmp 0x1400dd17f
mov rdx, qword [rbp - 0x48]
cmp eax, r8d
jae 0x1400dd1b7
mov r8, qword [rdx + 8]
cmp eax, dword [r8 + 8]
jae 0x1400dd1b2
mov edx, eax
movzx edx, word [r8 + rdx*4 + 0x10]
cmp eax, ecx
jae 0x1400dd1b2
mov r8d, eax
mov word [rbx + r8*2 + 0x10], dx
inc eax
mov edx, ecx
mov r8, qword [rbp - 0x48]
mov r8d, dword [r8 + 0x10]
mov r10d, r8d
cmp edx, r10d
jg 0x1400dd1b0
mov r10d, edx
cmp eax, r10d
jl 0x1400dd155
mov eax, r8d
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
jmp 0x1400dd194
call fcn.14013af20
call fcn.1400d7190
int3
Function at 0x1400e0a70
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rcx
cmp dword [rbx + 0x198], 0xffffffff
jne 0x1400e0b79
lea rsi, [0x1402477a0]
cmp qword [rsi - 8], 0
jne 0x1400e0b97
cmp byte [rsi], 0
jne 0x1400e0b79
lea rdi, [0x1402474e0]
cmp qword [rdi - 8], 0
jne 0x1400e0ba1
cmp byte [rdi], 0
jne 0x1400e0adf
movzx ecx, byte [rbx + 0x1b8]
test ecx, ecx
je 0x1400e0bb4
mov rcx, qword [rbx + 8]
mov edx, 0x80000000
xor r8d, r8d
mov qword [rbp + 0x10], rbx
cmp byte [rbx + 0x1b8], 0
cmovne edx, r8d
or edx, 0x2000100c
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x1400e0b90
add rcx, 0xc
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.1400076d0
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140007720
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
inc eax
xor ecx, ecx
cmp eax, 6
cmovg eax, ecx
mov ecx, eax
mov rbx, qword [rbp + 0x10]
mov dword [rbx + 0x198], ecx
mov eax, dword [rbx + 0x198]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x1400e0b11
call fcn.14000146b
jmp 0x1400e0ab0
call fcn.14000127e
cmp byte [rdi], 0
je 0x1400e0ad0
jmp 0x1400e0adf
mov rcx, rbx
mov edx, 0x100c
call fcn.1400e2fb0
mov ecx, eax
mov qword [rbp + 0x10], rbx
jmp 0x1400e0b6f
Function at 0x1400e3620
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x14074a380]
mov qword [rbp + 0x48], rax
test dword [rsp], esp
sub rsp, 0x430
lea rbx, [rsp + 0x20]
test rcx, rcx
je 0x1400e36df
add rcx, 0xc
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov r8, rbx
mov qword [rbp + 0x30], r8
mov r9d, 0x212
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.1400076d0
mov rcx, qword [rbp + 0x38]
mov edx, dword [rbp + 0x44]
mov r8, qword [rbp + 0x30]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov esi, eax
lea rcx, [rbp + 8]
call fcn.140007720
xor ecx, ecx
mov qword [rbp + 0x50], rcx
test esi, esi
jle 0x1400e36e6
mov rcx, rbx
call fcn.1400bd640
lea rcx, [0x14074a380]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x1400e36cd
call fcn.1400055d0
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x1400e3662
xor eax, eax
jmp 0x1400e36b8

Function at 0x1400e36f0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x1400e3726
add rcx, 0xc
jmp 0x1400e3728
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.1400076d0
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140007720
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400e3790
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov r8d, edx
or edx, 0x80000000
cmp byte [rcx + 0x1b8], 0
cmove r8d, edx
mov rcx, qword [rcx + 8]
mov edx, r8d
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x1400e3842
add rcx, 0xc
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.1400076d0
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140007720
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x1400e37df
Function at 0x1400e3da0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x14074a380]
mov qword [rbp + 0x48], rax
mov rbx, rcx
test dword [rsp], esp
sub rsp, 0xb0
lea rsi, [rsp + 0x20]
lea rdi, [0x1402474e0]
cmp qword [rdi - 8], 0
jne 0x1400e3fde
cmp byte [rdi], 0
jne 0x1400e3ea0
mov rcx, rbx
call fcn.1400e29c0
test eax, eax
je 0x1400e3e9c
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400e3e95
add rcx, 0xc
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov r8, rsi
mov qword [rbp + 0x30], r8
mov edx, 0x5c
mov dword [rbp + 0x44], edx
mov r9d, 0x55
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.1400076d0
mov rcx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
mov edx, dword [rbp + 0x44]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov ebx, eax
lea rcx, [rbp + 8]
call fcn.140007720
xor eax, eax
mov qword [rbp + 0x50], rax
test ebx, ebx
setne bl
movzx ebx, bl
movzx eax, bl
lea rcx, [0x14074a380]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x1400e3e83
call fcn.1400055d0
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ecx, ecx
jmp 0x1400e3e14
xor ebx, ebx
jmp 0x1400e3e6b
mov rcx, qword [rbx + 8]
mov r8, rsi
mov edx, 0x5c
mov r9d, 0x55
call fcn.14013b330
mov r8d, eax
test r8d, r8d
je 0x1400e3e9c
dec r8d
mov rcx, rsi
xor edx, edx
call fcn.1400bd6b0
lea rcx, [rbx + 8]
mov rdx, rax
call fcn.140005c60
mov rdi, qword [rbx + 8]
mov rcx, rdi
mov r8, rsi
mov edx, 0x20000071
mov r9d, 2
call fcn.14013b330
test eax, eax
je 0x1400e3e9c
cmp dword [rsi], 0
setne cl
mov byte [rbx + 0x1ba], cl
lea rcx, [rbx + 0x10]
mov rdx, rdi
call fcn.140005c60
cmp byte [rbx + 0x1ba], 0
je 0x1400e3f5b
lea rcx, [rbx + 0x18]
mov rdx, rdi
call fcn.140005c60
mov rcx, rdi
mov rdx, rsi
mov r8d, 0x55
call fcn.14013b440
mov r8d, eax
test r8d, r8d
jle 0x1400e3e9c
dec r8d
mov rcx, rsi
xor edx, edx
call fcn.1400bd6b0
lea rcx, [rbx + 0x38]
mov rdx, rax
call fcn.140005c60
jmp 0x1400e3fd4
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.140005c60
lea rcx, [rbx + 0x18]
mov rdx, rdi
call fcn.140005c60
mov rcx, rdi
mov r8, rsi
mov edx, 0x20000001
mov r9d, 2
call fcn.14013b330
test eax, eax
je 0x1400e3e9c
mov ecx, dword [rsi]
mov dword [rbx + 0x1b4], ecx
mov ecx, dword [rbx + 0x1b4]
call fcn.1400e13c0
test eax, eax
jne 0x1400e3fd4
mov rcx, rdi
mov edx, 0x5f
cmp dword [rcx], ecx
call fcn.1400c1aa0
test eax, eax
jle 0x1400e3fd4
mov rcx, rdi
mov r8d, eax
xor edx, edx
call fcn.1400c15e0
lea rcx, [rbx + 0x18]
mov rdx, rax
call fcn.140005c60
mov ebx, 1
jmp 0x1400e3e6b
call fcn.14000127e
jmp 0x1400e3dea
Function at 0x1400e5350
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov qword [rbx + 0x178], 0xffffffffffffffff
mov dword [rbx + 0x180], 0xffffffff
lea rcx, [rbx + 8]
mov rdx, rsi
call fcn.140005c60
lea rcx, [rbx + 0x90]
mov rdx, rdi
call fcn.140005c60
mov rcx, qword [rbx + 0x90]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r8d, eax
mov rdx, rsi
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400e53c0
Function at 0x1401330c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x40]
xorps xmm4, xmm4
movaps xmmword [rbp + 0x70], xmm4
xor eax, eax
mov qword [rbp + 0x80], rax
mov rax, qword [0x14074a380]
mov qword [rbp + 0x50], rax
mov rsi, rcx
mov rbx, rdx
mov edi, dword [rbx + 8]
shl edi, 2
cmp edi, 0x400
jge 0x140133152
mov edx, edi
mov r14, rdx
test r14, r14
je 0x140133148
mov rcx, r14
add rcx, 0xf
and rcx, 0xfffffffffffffff0
add rsp, 0x40
neg rcx
add rcx, rsp
jb 0x14013312a
xor ecx, ecx
test dword [rsp], esp
sub rsp, 0x1000
cmp rsp, rcx
jae 0x14013312a
mov rsp, rcx
test dword [rsp], esp
sub rsp, 0x40
lea r14, [rsp + 0x40]
test edi, edi
jl 0x1401332e0
jmp 0x140133168
movsxd rdx, edi
lea rcx, [0x14029cba0]
call fcn.140005b70
lea r14, [rax + 0x10]
mov edi, dword [rax + 8]
mov qword [rbp + 0x58], r14
mov qword [rbp + 0xd8], rbx
lea rcx, [rbx + 0xc]
mov qword [rbp + 0x80], rcx
mov r15, qword [rbp + 0x80]
xor r13d, r13d
test edi, edi
cmovne r13, r14
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x78], r13
lea rcx, [rbp]
call fcn.1400076d0
call sub.KERNEL32.dll_GetConsoleOutputCP
mov ebx, eax
lea rcx, [rbp]
call fcn.140007720
mov ecx, ebx
mov rbx, qword [rbp + 0xd8]
mov r9d, dword [rbx + 8]
mov r13, qword [rbp + 0x60]
mov r8, r13
mov dword [rsp + 0x28], edi
xor edx, edx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rdx
mov dword [rbp + 0x4c], ecx
mov dword [rbp + 0x48], r9d
mov qword [rsp + 0x20], r8
mov r8, r15
mov qword [rbp + 0x3c], r8
mov dword [rbp + 0x44], edx
lea rcx, [rbp]
call fcn.1400076d0
mov ecx, dword [rbp + 0x4c]
mov r9d, dword [rbp + 0x48]
mov r8, qword [rbp + 0x3c]
mov edx, dword [rbp + 0x44]
call sub.KERNEL32.dll_WideCharToMultiByte
mov ebx, eax
lea rcx, [rbp]
call fcn.140007720
xor ecx, ecx
mov qword [rbp + 0x78], rcx
mov qword [rbp + 0x80], rcx
test edi, edi
cmovne rcx, qword [rbp + 0x58]
mov qword [rbp + 0x70], rcx
mov rdi, rcx
lea r14, [rbp + 0x6c]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov qword [rbp + 0x3c], rcx
mov rdx, rdi
mov qword [rbp + 0x34], rdx
mov r8d, ebx
mov dword [rbp + 0x44], r8d
mov r9, r14
mov qword [rbp + 0x2c], r9
lea rcx, [rbp]
call fcn.1400076d0
mov rcx, qword [rbp + 0x3c]
mov rdx, qword [rbp + 0x34]
mov r8d, dword [rbp + 0x44]
mov r9, qword [rbp + 0x2c]
call sub.KERNEL32.dll_WriteFile
lea rcx, [rbp]
call fcn.140007720
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
mov rax, qword gs:[0x58]
mov ecx, dword [0x14075a6f8]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rcx, rdx
mov rsi, qword [rcx]
test rsi, rsi
je 0x1401332e6
mov dword [rsi + 0x90], ebx
xor eax, eax
mov qword [rbp + 0x70], rax
lea rcx, [0x14074a380]
mov rcx, qword [rcx]
cmp qword [rbp + 0x50], rcx
je 0x1401332cb
call fcn.1400055d0
nop
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1400d7120
int3
lea rax, [0x140138390]
call rax
mov rsi, rax
jmp 0x1401332aa
Function at 0x14013b330
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x14013b359
add rcx, 0xc
jmp 0x14013b35b
xor ecx, ecx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x44], edx
mov qword [rbp - 0x58], r8
mov dword [rbp - 0x48], r9d
lea rcx, [rbp - 0x80]
call fcn.1400076d0
mov rcx, qword [rbp - 0x50]
mov edx, dword [rbp - 0x44]
mov r8, qword [rbp - 0x58]
mov r9d, dword [rbp - 0x48]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov ebx, eax
lea rcx, [rbp - 0x80]
call fcn.140007720
mov eax, ebx
xor ecx, ecx
mov qword [rbp - 0x40], rcx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14013b4c0
Capabilities:
Create directory

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
test rcx, rcx
je 0x14013b4ef
add rcx, 0xc
mov rsi, rcx
jmp 0x14013b4f1
xor esi, esi
mov qword [rbp - 0x40], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rsi
mov qword [rbp - 0x48], rcx
mov rdx, rbx
mov qword [rbp - 0x50], rdx
lea rcx, [rbp - 0x78]
call fcn.1400076d0
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
call sub.KERNEL32.dll_CreateDirectoryW
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.140007720
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
test ebx, ebx
setne bl
movzx ebx, bl
mov rax, qword gs:[0x58]
mov ecx, dword [0x14075a6f8]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x14013b57a
mov dword [rdi + 0x90], esi
movzx eax, bl
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x140138390]
call rax
mov rdi, rax
jmp 0x14013b560

Function at 0x14013ba60
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x14013ba8c
add rcx, 0xc
mov rbx, rcx
jmp 0x14013ba8e
xor ebx, ebx
mov qword [rbp - 0x40], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rbx
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x70]
call fcn.1400076d0
mov rcx, qword [rbp - 0x48]
call sub.KERNEL32.dll_DeleteFileW
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.140007720
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
test ebx, ebx
setne bl
movzx ebx, bl
mov rax, qword gs:[0x58]
mov ecx, dword [0x14075a6f8]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x14013bb0c
mov dword [rdi + 0x90], esi
movzx eax, bl
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x140138390]
call rax
mov rdi, rax
jmp 0x14013baf2
Function at 0x14013cf60
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov r14, r9
mov r15, qword [rbp + 0x38]
xor ecx, ecx
mov dword [rbp - 0x3c], ecx
mov byte [rbp - 0x4c], 0
lea rcx, [0x140244cd8]
call fcn.1401e1d80
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], r15
mov r13d, dword [rbp + 0x30]
mov dword [rsp + 0x20], r13d
mov qword [rsp + 0x28], r15
mov rdx, rsi
mov qword [rbp - 0x60], rdx
mov r8, rdi
mov qword [rbp - 0x68], r8
mov r9, r14
mov qword [rbp - 0x70], r9
mov rcx, rbx
mov qword [rbp - 0x78], rcx
lea rcx, [rbp - 0xa0]
call fcn.1400076d0
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
call sub.KERNEL32.dll_CreateThread
mov rbx, rax
lea rcx, [rbp - 0xa0]
call fcn.140007720
nop
xor eax, eax
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x3c], 1
mov byte [rbp - 0x4c], 1
mov rax, qword [rbp - 0x58]
mov qword [rax + 8], rbx
mov rcx, rax
mov rax, rcx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14013d0b0
Capabilities:
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x48], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14011fca0
mov rcx, qword [rbp - 0x48]
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x50], rcx
lea rcx, [rbp - 0x78]
call fcn.1400076d0
mov rcx, qword [rbp - 0x50]
call sub.KERNEL32.dll_ResumeThread
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.140007720
nop
cmp byte [rbp - 0x40], 0
je 0x14013d121
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.14011fce0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14013ded0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov ebx, r8d
mov qword [rbp - 0x40], rdx
mov rsi, rdx
test rcx, rcx
je 0x14013df0a
add rcx, 0xc
mov rdi, rcx
jmp 0x14013df0c
xor edi, edi
mov qword [rbp - 0x48], rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x54], rcx
mov rdx, rsi
mov qword [rbp - 0x5c], rdx
mov r8d, ebx
mov dword [rbp - 0x4c], r8d
lea rcx, [rbp - 0x88]
call fcn.1400076d0
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.140007720
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x14075a6f8]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x14013dfa1
mov dword [rdi + 0x90], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x140138390]
call rax
mov rdi, rax
jmp 0x14013df88
Function at 0x14013e5c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov edi, edx
mov rbx, r8
mov rsi, r9
mov r14, qword [rbp + 0x38]
mov r15, qword [rbp + 0x40]
mov r13, qword [rbp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14011fca0
nop
lea rcx, [r13 + 0x10]
xor edx, edx
test r13, r13
cmove rcx, rdx
mov qword [rbp - 0x50], rcx
lea rdx, [r15 + 0x10]
xor r8d, r8d
test r15, r15
cmove rdx, r8
mov qword [rbp - 0x58], rdx
lea r8, [r14 + 0x10]
xor r9d, r9d
test r14, r14
cmove r8, r9
mov qword [rbp - 0x60], r8
mov qword [rbp - 0x68], rsi
mov r9, rsi
lea rax, [rbx + 0x10]
xor r10d, r10d
test rbx, rbx
cmove rax, r10
mov qword [rbp - 0x70], rax
mov r10, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [r10 + 8]
mov qword [rbp - 0x7c], rcx
mov edx, edi
mov dword [rbp - 0x74], edx
mov r8, rax
mov qword [rbp - 0x84], r8
mov qword [rbp - 0x8c], r9
lea rcx, [rbp - 0xb8]
call fcn.1400076d0
mov rcx, qword [rbp - 0x7c]
mov edx, dword [rbp - 0x74]
mov r8, qword [rbp - 0x84]
mov r9, qword [rbp - 0x8c]
call sub.ADVAPI32.dll_RegEnumValueW
mov ebx, eax
lea rcx, [rbp - 0xb8]
call fcn.140007720
nop
xor ecx, ecx
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x14013e709
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.14011fce0
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret