joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140112f10
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push r15
sub rsp, 0x40
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov sil, r9b
movsxd rbx, r8d
mov r14d, edx
mov rdi, rcx
cmp edx, 0x104
jge 0x140112f54
mov dword [0], 1
xor ecx, ecx
int 0x29
xor r15d, r15d
mov word [rcx], r15w
test r8d, r8d
jns 0x140112f6f
mov dword [0], 1
xor ecx, ecx
int 0x29
cmp ebx, 0x27
ja 0x140112f84
movabs rcx, 0x8814010060
bt rcx, rbx
jb 0x140112f8f
mov ecx, 0x3ca4d6
call fcn.140175954
nop
mov r9d, r14d
mov r8, rdi
mov edx, ebx
lea rcx, [0x140360450]
call fcn.140112d88
test eax, eax
je 0x140113001
cmp eax, 2
jne 0x140112fb3
mov eax, 0x80004005
jmp 0x140113001
mov eax, ebx
bts eax, 0xf
mov edx, ebx
test sil, sil
cmovne edx, eax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test eax, eax
js 0x140113001
mov edx, r14d
mov rcx, rdi
call fcn.140108bec
nop
mov r8, rdi
mov edx, ebx
lea rcx, [0x140360450]
call fcn.140112cb0
nop
mov eax, esi
jmp 0x140113001
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x14011367c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
mov rsi, rdx
movzx eax, byte [r8 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rdx
cmp r8, 4
jb 0x1401136a6
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1401136fe
cmp qword [rcx + rdx*8], rdi
jne 0x1401136f8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14011370b
mov rax, qword [rdi + 8]
jmp 0x1401136f1
cmp qword [rcx + rdx*8], rdi
jne 0x140113710
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rdi, qword [rsp + 0x40]
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x18]
mov rbx, qword [rdi]
mov dl, 1
mov qword [rax], rbx
mov r8, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [r8 + 8], rax
xor r8d, r8d
dec qword [r9 + 0x10]
call fcn.14000b190
mov rcx, rdi
call fcn.14015729c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140114f20
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
xor r9d, r9d
mov rdx, rcx
test rcx, rcx
jne 0x140114f2f
or eax, 0xffffffff
ret
movzx eax, word [rdx]
mov ecx, 0x1505
test ax, ax
je 0x140114f54
mov r8, r9
imul ecx, ecx, 0x21
inc r8
movzx eax, ax
xor ecx, eax
movzx eax, word [rdx + r8*2]
test ax, ax
jne 0x140114f3f
imul eax, ecx, 0x41c64e6d
imul ecx, ecx, 0x10dcd
add eax, 0x3039
inc ecx
shr eax, 0x10
and ecx, 0xffff0000
or eax, ecx
ret
Function at 0x140117398
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
lea eax, [rdx + rdx]
xor ebx, ebx
mov dword [rsp + 0x58], eax
lea r8, str.office.odf
lea rax, [r11 + 0x10]
mov qword [r11 - 0x18], rax
lea rdx, str.SoftwareMicrosoftOffice16.0CommonFilesPaths
mov qword [r11 - 0x20], rcx
lea r9d, [rbx + 2]
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x28], rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
sete al
add rsp, 0x40
pop rbx
ret

Function at 0x140117530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
and dword [r9], 0
mov r14, r9
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x140117590
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140117590
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140117590
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [r14], eax
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140121830
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push r15
sub rsp, 0x40
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140121868
mov r8, qword [r8]
movabs rcx, 0xcbf29ce484222325
xor edx, edx
add r9, r9
je 0x140121897
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r10, 0x100000001b3
imul rcx, r10
inc rdx
cmp rdx, r9
jb 0x140121879
mov r15, qword [rsi + 0x30]
and r15, rcx
add r15, r15
mov rbx, qword [rsi + 0x18]
mov rbx, qword [rbx + r15*8]
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x18]
cmp qword [rcx + r15*8], rax
je 0x1401218bf
mov rax, qword [rcx + r15*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14012192c
lea rcx, [rbx + 0x10]
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x1401218d8
mov r9, qword [rdi]
jmp 0x1401218db
mov r9, rdi
mov qword [rsp + 0x20], rax
mov r8, qword [rcx + 0x10]
xor edx, edx
call fcn.14000b8a0
nop
nop dword [rax]
test eax, eax
je 0x1401218f9
mov rbx, qword [rbx]
jmp 0x1401218a9
lea r9, [rbx + 0x10]
mov rax, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 8
jb 0x14012190b
mov r9, qword [r9]
mov qword [rsp + 0x20], rax
mov r8, qword [rdi + 0x10]
xor edx, edx
mov rcx, rdi
call fcn.14000b8a0
nop
test eax, eax
je 0x140121927
mov rbx, qword [rsi + 8]
mov qword [r14], rbx
jmp 0x140121933
mov rax, qword [rsi + 8]
mov qword [r14], rax
mov rax, r14
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
Function at 0x140134df0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140134e81
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140134e81
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140134e81
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140134e65
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140134e5f
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140134e67
add rdx, 0x28
jmp 0x140134e44
xor edx, edx
test rdx, rdx
jne 0x140134e70
xor al, al
jmp 0x140134e87
test dword [rdx + 0x24], 0x80000000
je 0x140134e7d
xor al, al
jmp 0x140134e87
mov al, 1
jmp 0x140134e87
xor al, al
jmp 0x140134e87
add rsp, 0x18
ret

Function at 0x14013566c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14013bec0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14013bed3
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14013c4f0
lea rdx, [0x140295140]
lea rcx, [rsp + 0x20]
call fcn.1401377ec
int3

Function at 0x14013c020
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call sub.KERNEL32.dll_CreateThread
mov rbx, rax
test rax, rax
je 0x14013c064
mov ecx, 1
lock xadd dword [0x1403633f8], ecx
inc ecx
cmp ecx, 1
jne 0x14013c064
call fcn.14013c070
lock inc dword [0x1403348f0]
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140142d08
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rdx
mov rbx, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [rdx + r10]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 4
jb 0x140142d20
movsxd rcx, dword [rbx]
xor edx, edx
mov rax, r9
div rcx
mov rax, qword [rbx + 8]
movsxd rcx, edx
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x140142d6a
mov ecx, dword [r11]
cmp dword [rax + 8], ecx
je 0x140142d6c
mov rax, qword [rax]
test rax, rax
jne 0x140142d5d
xor eax, eax
test rax, rax
je 0x140142d7c
test r8, r8
je 0x140142d7c
mov ecx, dword [rax + 0xc]
mov dword [r8], ecx
mov rbx, qword [rsp + 8]
ret

Function at 0x140146afc
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140363468]
xor edx, edx
jmp fcn.14013bec0
Function at 0x140146dc4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [rdx + r10]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 8
jb 0x140146ddc
movsxd rcx, dword [r11]
xor edx, edx
mov r10, qword [r11 + 8]
mov rax, r9
div rcx
movsxd r9, edx
xor edx, edx
mov rcx, qword [r10 + r9*8]
test rcx, rcx
je 0x140146e2c
mov rax, qword [rbx]
cmp qword [rcx + 8], rax
je 0x140146e4d
mov rdx, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x140146e1b
xor ecx, ecx
test rcx, rcx
je 0x140146e64
test r8, r8
je 0x140146e3f
mov rdx, qword [rcx + 0x10]
mov qword [r8], rdx
mov edx, 0x18
call fcn.140135a04
mov al, 1
jmp 0x140146e66
mov rax, qword [rcx]
test rdx, rdx
jne 0x140146e5b
mov qword [r10 + r9*8], rax
jmp 0x140146e5e
mov qword [rdx], rax
dec dword [r11 + 4]
jmp 0x140146e2e
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1401474d4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140363468]
jmp fcn.14013bec0

Function at 0x140147ed0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rdx
mov rbx, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [rdx + r10]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 8
jb 0x140147ee8
movsxd rcx, dword [rbx]
xor edx, edx
mov rax, r9
div rcx
mov rax, qword [rbx + 8]
movsxd rcx, edx
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x140147f33
mov rcx, qword [r11]
cmp qword [rax + 8], rcx
je 0x140147f35
mov rax, qword [rax]
test rax, rax
jne 0x140147f25
xor eax, eax
test rax, rax
je 0x140147f46
test r8, r8
je 0x140147f46
mov rcx, qword [rax + 0x10]
mov qword [r8], rcx
mov rbx, qword [rsp + 8]
ret

Function at 0x1401482a8
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rdi, rcx
xor esi, esi
test dword [0x1403348f0], 0x80000000
je 0x1401482e4
mov ecx, dword [0x140363468]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
test rax, rax
jne 0x1401482ec
call fcn.140142858
mov rbx, rax
cmp qword [rbx + 0x40], rsi
jne 0x1401482fa
mov rcx, rbx
call fcn.140146b0c
mov rax, qword [rbx + 0x40]
mov ecx, dword [rax + 0xa0]
cmp rbx, qword [rdi + 0x18]
jne 0x140148317
cmp ecx, dword [rdi + 0xd0]
jne 0x140148317
mov rax, rdi
jmp 0x14014838d
mov rcx, rbx
call fcn.140146f00
test rax, rax
je 0x14014832d
cmp qword [rax + 0xa8], rdi
je 0x14014838d
mov rdx, rdi
mov rcx, rbx
call fcn.140147f4c
test rax, rax
jne 0x14014838d
mov ecx, 0xe8
call fcn.14000e5ac
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140148362
mov r8b, 1
mov rdx, rdi
mov rcx, rax
call fcn.140147a18
mov rsi, rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov rcx, rbx
call fcn.140147520
lea rcx, [rbx + 0xd0]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
call fcn.140147fd4
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1401483a0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x1401483d4
test dword [0x1403348f0], 0x80000000
je 0x1401483cb
mov ecx, dword [0x140363468]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x1401483d0
call fcn.140142858
mov qword [rbx + 0x18], rax
mov rcx, rbx
call fcn.1401535bc
test al, al
je 0x140148420
mov edx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shl edx, 4
sar edx, 4
test edx, edx
js 0x140148400
mov rcx, rax
call fcn.140146710
mov edx, 3
jmp 0x14014840c
lock inc dword [rax + 0xc4]
mov edx, 2
mov rcx, rbx
call fcn.140153558
mov rcx, qword [rbx + 0x18]
mov rdx, rbx
call fcn.1401467c0
add rsp, 0x20
pop rbx
ret

Function at 0x14014adc4
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
xor ebx, ebx
mov ecx, dword [rax + 0xb0]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x14014ade8
mov cl, al
and cl, 3
cmove rbx, rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1401546c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 0x30]
mov rdi, rcx
mov rdx, qword [rax + 0x18]
mov ecx, dword [rdx + 0xb0]
call sub.KERNEL32.dll_TlsGetValue
mov r8, rax
test rax, rax
je 0x14015470b
mov dl, al
and dl, 3
cmp dl, 1
jne 0x14015470b
and r8, 0xfffffffffffffffe
je 0x14015470b
mov rax, qword [rdi + 0x80]
cmp r8, rax
jne 0x14015470b
and qword [r8 + 0x20], 0
jmp 0x140154740
and dword [rsp + 0x28], 0
lea rax, [0x14013c2cc]
mov qword [rsp + 0x30], rax
jmp 0x140154734
mov rax, qword [rdi + 0x88]
test rax, rax
jne 0x140154740
lea rcx, [rsp + 0x20]
call fcn.140139b6c
mov rax, qword [rdi + 0x80]
test rax, rax
jne 0x14015471e
mov rax, qword [rdi]
mov rbx, qword [rax + 0x40]
mov rcx, rbx
call fcn.1401359fc
mov edx, 1
mov rcx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp rax

Function at 0x140154ec0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
xor r8d, r8d
mov r11, rdx
mov r10d, r8d
mov rbx, rcx
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rdx + r10]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 4
jb 0x140154edb
movsxd rcx, dword [rbx]
xor edx, edx
mov rax, r9
div rcx
mov rax, qword [rbx + 8]
movsxd rcx, edx
mov rdx, qword [rax + rcx*8]
test rdx, rdx
je 0x140154f25
mov eax, dword [r11]
cmp dword [rdx + 8], eax
je 0x140154f28
mov rdx, qword [rdx]
test rdx, rdx
jne 0x140154f18
mov rdx, r8
mov rbx, qword [rsp + 8]
test rdx, rdx
setne al
ret
Function at 0x140164b3c
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
movsxd r13, ecx
lea r10, [0x140363a70]
mov rdi, r13
mov r15, r13
sar r15, 6
and edi, 0x3f
shl rdi, 6
mov r14, rdx
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
mov rcx, qword [rax + rdi + 0x28]
mov qword [rsp + 0x98], rcx
test r8, r8
je 0x140164b93
cmp word [rdx], r9w
jne 0x140164b93
or byte [rax + rdi + 0x38], 4
jmp 0x140164b98
and byte [rax + rdi + 0x38], 0xfb
lea r12, [rdx + r8*2]
mov rsi, rdx
mov rbx, rdx
cmp rdx, r12
jae 0x140164d4d
lea rbp, [rdx + 2]
mov edx, reloc.Cabinet.dll_FCIFlushCabinet
movzx eax, word [rsi]
cmp ax, 0x1a
je 0x140164d2f
cmp ax, dx
je 0x140164bda
mov word [rbx], ax
add rbx, 2
add rsi, 2
add rbp, 2
jmp 0x140164c74
cmp rbp, r12
jae 0x140164bfd
cmp word [rbp], r9w
jne 0x140164bf8
add rsi, 4
mov word [rbx], r9w
add rbp, 4
add rbx, 2
jmp 0x140164c74
mov word [rbx], dx
jmp 0x140164bc9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8d, 2
lea rdx, [rsp + 0x80]
add rsi, 2
add rbp, 2
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140164d13
cmp dword [rsp + 0x90], 0
je 0x140164d13
lea r10, [0x140363a70]
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
test byte [rax + rdi + 0x38], 0x48
je 0x140164cba
movzx eax, word [rsp + 0x80]
cmp ax, r9w
jne 0x140164c82
mov word [rbx], r9w
mov edx, reloc.Cabinet.dll_FCIFlushCabinet
mov rcx, qword [rsp + 0x98]
cmp rsi, r12
jb 0x140164bb4
jmp 0x140164d4d
mov ecx, reloc.Cabinet.dll_FCIFlushCabinet
mov word [rsp + 0x88], ax
mov word [rbx], cx
xor edx, edx
mov rcx, qword [r10 + r15*8]
mov al, byte [rsp + rdx + 0x88]
add rcx, rdi
mov byte [rcx + rdx + 0x3a], al
inc rdx
cmp rdx, 2
jl 0x140164c94
mov rax, qword [r10 + r15*8]
mov byte [rax + rdi + 0x3c], r9b
jmp 0x140164c67
cmp word [rsp + 0x80], r9w
jne 0x140164cd4
cmp rbx, r14
jne 0x140164cd4
mov word [rbx], r9w
add rbx, 2
jmp 0x140164c67
mov rdx, 0xfffffffffffffffe
mov ecx, r13d
lea r8d, [rdx + 3]
call fcn.140166218
mov r9d, 0xa
lea r10, [0x140363a70]
cmp word [rsp + 0x80], r9w
je 0x140164c67
lea edx, [r9 + 3]
mov word [rbx], dx
add rbx, 2
jmp 0x140164c6c
mov edx, reloc.Cabinet.dll_FCIFlushCabinet
lea r10, [0x140363a70]
mov word [rbx], dx
add rbx, 2
lea r9d, [rdx - 3]
jmp 0x140164c6c
mov rcx, qword [r10 + r15*8]
mov al, byte [rcx + rdi + 0x38]
test al, 0x40
jne 0x140164d43
or al, 2
mov byte [rcx + rdi + 0x38], al
jmp 0x140164d4d
movzx ecx, word [rsi]
mov word [rbx], cx
add rbx, 2
sub rbx, r14
sar rbx, 1
lea rax, [rbx + rbx]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1401688b4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.14016ec3c
test al, al
je 0x1401688ec
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
shr edx, 8
test dl, 1
jne 0x1401688ec
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.140168900
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1401785e4
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x400
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
cmp qword [rcx + 0x18], 8
mov rsi, r8
mov dil, dl
mov rbx, rcx
jb 0x14017861b
mov rcx, qword [rcx]
lea r8, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14017863a
cmp dword [rsp + 0x30], 0xffffffff
je 0x14017863a
test byte [rsp + 0x30], 0x10
jne 0x14017865d
cmp qword [rbx + 0x18], 8
jb 0x140178646
mov rcx, qword [rbx]
jmp 0x140178649
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14017865d
test dil, dil
jne 0x140178684
jmp 0x14017865f
mov al, 1
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.140135130
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.CreateDirectory_failed_for_directory:__s
mov qword [rsp + 0x20], rbx
mov r8d, eax
lea rcx, [rsp + 0x60]
mov edx, 0xf
call fcn.140175be0
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x60]
call fcn.1401377ec
int3

Function at 0x1401786bc
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x3d0
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
cmp qword [rcx + 0x18], 8
mov dil, dl
mov rbx, rcx
jb 0x1401786eb
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14017873f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14017873f
cmp eax, 5
jne 0x140178732
mov r8b, dil
lea edx, [rax + 0x7b]
mov rcx, rbx
call fcn.140178df0
cmp qword [rbx + 0x18], 8
jb 0x14017871f
mov rcx, qword [rbx]
jmp 0x140178722
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14017873f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14017873f
test dil, dil
jne 0x140178762
xor al, al
jmp 0x140178741
mov al, 1
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140135130
mov rbx, qword [rsp + 0x3e8]
add rsp, 0x3d0
pop rdi
ret
lea r9, str.failed_to_delete_file__s
mov qword [rsp + 0x20], rbx
mov r8d, eax
lea rcx, [rsp + 0x30]
mov edx, 0xf
call fcn.1401759ec
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x30]
call fcn.1401377ec
int3
Function at 0x140178930
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x3c0
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
xor edi, edi
mov edx, 0x104
mov rbx, rcx
cmp qword [rcx + 0x10], rdx
jb 0x14017897b
mov qword [rcx + 0x10], rdx
cmp qword [rcx + 0x18], 8
jb 0x14017896f
mov rax, qword [rcx]
jmp 0x140178972
mov rax, rcx
mov word [rax + 0x208], di
jmp 0x140178987
sub rdx, qword [rcx + 0x10]
xor r8d, r8d
call fcn.14000b4a0
cmp qword [rbx + 0x18], 8
jb 0x140178993
mov rdx, qword [rbx]
jmp 0x140178996
mov rdx, rbx
mov eax, 0xffffffff
cmp qword [rbx + 0x18], rax
ja 0x1401789fe
mov ecx, dword [rbx + 0x18]
call sub.KERNEL32.dll_GetTempPathW
test eax, eax
je 0x140178a34
movsxd rdx, eax
cmp rdx, qword [rbx + 0x10]
ja 0x1401789ce
mov qword [rbx + 0x10], rdx
cmp qword [rbx + 0x18], 8
jb 0x1401789c8
mov rbx, qword [rbx]
mov word [rbx + rdx*2], di
jmp 0x1401789dd
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.14000b4a0
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.140135130
mov rbx, qword [rsp + 0x3d8]
add rsp, 0x3c0
pop rdi
ret
lea rdx, [0x140294a58]
mov dword [rsp + 0x20], 0x5d
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x224], edi
mov word [rsp + 0x328], di
mov word [rsp + 0x228], di
mov word [rsp + 0x24], di
call fcn.1401377ec
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Cannot_get_temp_path
mov edx, 0xf
mov r8d, eax
lea rcx, [rsp + 0x20]
call fcn.140175968
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x20]
call fcn.1401377ec
int3

Function at 0x140178df0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x3e0
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
cmp qword [rcx + 0x18], 8
mov dil, r8b
mov rbx, rcx
mov dword [rsp + 0x30], edx
jb 0x140178e23
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140178e32
test dil, dil
jne 0x140178e53
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.140135130
mov rbx, qword [rsp + 0x400]
add rsp, 0x3e0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Cannot_set_file__s_attbutes_to__u
mov edx, 0xf
mov r8d, eax
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call fcn.140175aa0
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x40]
call fcn.1401377ec
int3
Function at 0x14017dac8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x3e0
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x14017db6d
cmp qword [rdx + 0x18], 8
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 4
jb 0x14017db10
mov rdx, qword [rdx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14017db3f
cmp eax, 2
je 0x14017db4a
cmp eax, 0xea
je 0x14017db4a
jmp 0x14017db95
cmp dword [rsp + 0x30], 4
jne 0x14017db4a
mov al, 1
jmp 0x14017db4c
xor al, al
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.140135130
mov rbx, qword [rsp + 0x408]
add rsp, 0x3e0
pop rdi
ret
lea r8, str.ORegistryKey.GetValue_failure:_Cannot_get_DWORD_value._The_registry_key_is_closed_or_not_set
mov edx, 0x3a
lea rcx, [rsp + 0x40]
call fcn.1401799e0
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x40]
call fcn.1401377ec
int3
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
lea r9, str.ORegistryKey.GetValue_failure:_Cannot_get_registry__s_value__s
lea rcx, [rsp + 0x40]
mov r8d, eax
mov edx, 0xf
call fcn.140179730
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x40]
call fcn.1401377ec
int3