joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4da7ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4da82a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4da821
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4da821
mov rax, qword [rbp - 8]
jmp 0x2fc4da83f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4da7f4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180002c30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x30]
lea rcx, [0x1800ec10b]
call fcn.180004900
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
cmp dword [rbp + 0xc0], 1
je 0x180002c7c
jmp 0x180002ca5
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0xf0]
lea r8, [0x180002630]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x180020f40
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.180020a20
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180020f7f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1800b4410]
jmp 0x180020f89
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x18007dbd0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x180083fa0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180083e30
lea rcx, [rsp + 0x40]
call fcn.180083f60
movzx eax, al
test eax, eax
jne 0x180083fe8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.180083e50
mov rax, qword [rsp + 0x70]
jmp 0x1800841b9
lea rcx, [rsp + 0x40]
call fcn.180083f40
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.180083ef0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.180083f40
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180083d00
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x18008408e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.180083e50
mov rax, qword [rsp + 0x80]
jmp 0x1800841b9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.18002e250
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000a140
lea rcx, [rsp + 0x48]
call fcn.18000a1c0
movzx eax, al
test eax, eax
jne 0x1800840f5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.18000a180
lea rcx, [rsp + 0x40]
call fcn.180083e50
mov rax, qword [rsp + 0x88]
jmp 0x1800841b9
lea rcx, [rsp + 0x48]
call fcn.18000a2b0
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.180083f40
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.180083d00
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x18008418b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.18000a180
lea rcx, [rsp + 0x40]
call fcn.180083e50
mov rax, qword [rsp + 0xa0]
jmp 0x1800841b9
lea rcx, [rsp + 0x48]
call fcn.180028880
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.18000a180
lea rcx, [rsp + 0x40]
call fcn.180083e50
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x180087110
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1800863c0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180087177
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1800b4418]
jmp 0x180087199
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1800876a0
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x1800a74a0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1800b1610
sub rsp, rax
mov rax, qword [0x1800e0040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1800e1d10]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1800a7692
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1800a75e6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1800a75e6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1800a75cb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1800a7568
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800a7652
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1800a76b1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1800a768d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1800a76b1
jmp 0x1800a753e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.180004a90
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1800a76d0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1800b1610
sub rsp, rax
mov rax, qword [0x1800e0040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1800e1d10]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1800a78dd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1800a7829
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1800a7829
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1800a7809
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1800a7798
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800a789d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1800a78fc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1800a78d8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1800a78fc
jmp 0x1800a776e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.180004a90
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140001310
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x248
mov rax, qword [0x140077698]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000135b
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000135b
mov ecx, 0xc00
call qword [case.0x140016c1a.0]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1400345b0
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
dec eax
cmp eax, 0x102
ja 0x140001391
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [0x1400578cc]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140033470
add rsp, 0x248
ret
Function at 0x1400053ac
Capabilities:
Create process on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
cmp dword [0x1400795f8], 0
je 0x1400053cd
call fcn.140005550
jmp 0x14000553b
and dword [rbp + 0x6f], 0
lea rdx, [rbp + 0x77]
call fcn.140003b38
nop
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x19]
call fcn.1400345b0
mov dword [rbp - 0x19], 0x68
xor edx, edx
lea r8d, [rdx + 0x18]
lea rcx, [rbp - 0x39]
call fcn.1400345b0
mov rdx, qword [rbp + 0x77]
mov r8d, dword [rdx - 0x10]
test r8d, r8d
js 0x140005544
mov ecx, 1
sub ecx, dword [rdx - 8]
mov eax, dword [rdx - 0xc]
sub eax, r8d
or eax, ecx
jge 0x140005433
mov edx, r8d
lea rcx, [rbp + 0x77]
call fcn.1400017ac
mov rdx, qword [rbp + 0x77]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400054b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x6f], eax
mov r9d, eax
mov r8, qword [rbp + 0x77]
lea rdx, str.InstallProduct:_CreateProcess_failed__Cmdline_s_Error_d_._n
lea rcx, [0x1400795c8]
call fcn.1400016a4
lea rcx, [0x140079450]
call fcn.1400102b0
mov eax, dword [rbp + 0x6f]
add eax, dword [0x140079650]
mov dword [rbp + 0x6f], eax
mov dword [0x1400796e8], eax
jmp 0x140005516
or edx, 0xffffffff
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x6f]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rbp + 0x6f]
mov ecx, 0xbc2
cmp eax, ecx
jne 0x1400054ea
cmp dword [0x1400795ec], 0
jne 0x1400054fb
mov dword [0x1400795ec], 1
test eax, eax
je 0x1400054fb
cmp eax, ecx
je 0x1400054fb
add eax, dword [0x140079650]
mov dword [rbp + 0x6f], eax
mov dword [0x1400796e8], eax
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x77]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000553b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140016c1a.0]
add rsp, 0xe0
pop rbp
ret
mov ecx, 0x80070057
call fcn.140001474
int3
Function at 0x140007c88
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x9c0]
sub rsp, 0xac0
mov rax, qword [0x140077698]
xor rax, rsp
mov qword [rbp + 0x9b0], rax
mov r15, rdx
mov rbx, rcx
mov qword [rsp + 0x58], rcx
lea rdx, [0x1400578cc]
lea rcx, [rsp + 0x50]
call fcn.1400019ac
nop
mov edi, 0x208
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x7a0]
call fcn.1400345b0
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x170]
call fcn.1400345b0
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x590]
call fcn.1400345b0
lea r12d, [rdi + 2]
mov ecx, r12d
call fcn.140012068
mov r14, rax
mov ecx, r12d
call fcn.140012068
mov rdi, rax
mov ecx, r12d
call fcn.140012068
mov rsi, rax
mov r8d, r12d
xor edx, edx
mov rcx, rdi
call fcn.1400345b0
mov r8d, r12d
xor edx, edx
mov rcx, rsi
call fcn.1400345b0
mov r8d, r12d
xor edx, edx
mov rcx, r14
call fcn.1400345b0
mov r12d, 0x104
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
mov r9, r14
mov r8d, r12d
lea rdx, [rbp + 0x7a0]
mov rcx, r15
call fcn.14003bdd8
test eax, eax
jne 0x140007ecc
mov r8, rdi
mov edx, r12d
lea rcx, [rbp + 0x170]
call fcn.14003b7c4
mov r8, rsi
mov edx, r12d
lea rcx, [rbp + 0x170]
call fcn.14003b744
lea rcx, [rsp + 0x58]
call fcn.140007f48
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400013f0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007dfa
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140016c1a.0]
mov rcx, qword [rsp + 0x50]
call fcn.14003879c
test rax, rax
je 0x140007ecc
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.1400345b0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x380]
call fcn.1400345b0
mov r8, qword [rsp + 0x50]
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.14003b7c4
lea r8, [0x1400583c4]
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.14003b744
lea r8, [rbp + 0x170]
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.14003b744
mov r8, r15
mov rdx, r12
lea rcx, [rbp + 0x380]
call fcn.14003b7c4
lea rcx, [rsp + 0x60]
call fcn.1400042b4
test eax, eax
jne 0x140007ecc
lea rcx, [rbp + 0x380]
call fcn.1400042b4
test eax, eax
je 0x140007ecc
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140007ecc
lea r8, [rbp + 0x170]
mov rdx, r12
lea rcx, [rbp + 0x590]
call fcn.14003b7c4
mov rcx, r14
call fcn.140012ca4
mov rcx, rdi
call fcn.140012ca4
mov rcx, rsi
call fcn.140012ca4
lea rdx, [rbp + 0x590]
mov rcx, rbx
call fcn.1400019ac
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140007f1a
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140016c1a.0]
mov rax, rbx
mov rcx, qword [rbp + 0x9b0]
xor rcx, rsp
call fcn.140033470
lea r11, [rsp + 0xac0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140007f48
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov eax, 2
mul rsi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140012068
mov rdi, rax
test rax, rax
je 0x140007fb9
lea r8, [rsi + rsi]
xor edx, edx
mov rcx, rax
call fcn.1400345b0
mov rdx, rdi
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140007fb9
mov rdx, rdi
mov rcx, rbx
call fcn.1400019ac
jmp 0x140007feb
mov rcx, rdi
call fcn.140012ca4
call fcn.14001269c
mov rcx, rax
test rax, rax
je 0x140008004
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140016c1a.0]
add rax, 0x18
mov qword [rbx], rax
mov rcx, rbx
call fcn.140001534
nop
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, 0x80004005
call fcn.140001474
int3

Function at 0x140008c78
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x20], 0
mov rbx, rcx
lea rcx, str.CExtInstDlgThread
mov r9d, 4
xor r8d, r8d
xor edx, edx
call fcn.14001c844
mov qword [rbx + 0x40], rax
mov dword [rax + 0x88], 0x3f1
mov rcx, qword [rbx + 0x40]
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor edi, edi
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140008ceb
cmp qword [rcx + 0x40], 0
je 0x140008ceb
mov rax, qword [rcx + 0x40]
mov qword [rbx + 0x48], rax
mov rax, qword [rcx + 0x58]
mov qword [rbx + 0x50], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp edi, 2
jge 0x140008cd0
inc edi
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140008cc0

Function at 0x14000a428
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov ebx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x3ff
and ax, cx
cmp ax, 1
je 0x14000a459
cmp ax, 0xd
jne 0x14000a45d
bts ebx, 0x14
mov r9d, edi
lea rcx, [0x140079450]
mov r8d, ebx
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400251a0
Function at 0x14000b4a8
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
cmp dword [0x1400795f8], 0
je 0x14000b4db
cmp dword [0x140079610], 0
jne 0x14000b4db
xor r9d, r9d
lea rdx, str.SOFTWAREAdobeSetupReader
mov r8d, 0x200
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
add rsp, 0x28
ret

Function at 0x14000b9f8
Capabilities:
Check if file exists
Copy file
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xbd0]
sub rsp, 0xcd0
mov rax, qword [0x140077698]
xor rax, rsp
mov qword [rbp + 0xbc0], rax
mov rdi, rdx
mov rbx, rcx
mov r15d, 0x20a
lea rcx, [rbp + 0x9b0]
mov r8d, r15d
xor edx, edx
mov sil, 1
call fcn.1400345b0
mov r14d, 0x105
lea rcx, [rbp + 0x9b0]
mov edx, r14d
mov r8, rbx
call fcn.14003b7c4
mov r8d, r15d
lea rcx, [rbp + 0x380]
xor edx, edx
call fcn.1400345b0
mov r8d, r15d
lea rcx, [rbp + 0x170]
xor edx, edx
call fcn.1400345b0
mov r8, rbx
lea rcx, [rbp + 0x380]
mov edx, r14d
call fcn.14003b7c4
mov r8, rdi
lea rcx, [rbp + 0x170]
mov edx, r14d
call fcn.14003b7c4
lea rcx, [rbp + 0x380]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14000bc5a
lea rcx, [rbp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14000bc5a
lea rcx, [rbp + 0x170]
call fcn.14003879c
cmp word [rbp + rax*2 + 0x16e], 0x5c
je 0x14000baf9
lea r8, [0x1400583c4]
mov edx, r14d
lea rcx, [rbp + 0x170]
call fcn.14003b744
lea rcx, [rbp + 0x380]
call fcn.14003879c
cmp word [rbp + rax*2 + 0x37e], 0x5c
je 0x14000bb26
lea r8, [0x1400583c4]
mov rdx, r14
lea rcx, [rbp + 0x380]
call fcn.14003b744
lea r8, [0x14005a97c]
mov rdx, r14
lea rcx, [rbp + 0x9b0]
call fcn.14003b744
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x9b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
test rax, rax
je 0x14000bc5a
test byte [rsp + 0x20], 0x10
jne 0x14000bc31
mov r8, r15
lea rcx, [rbp + 0x590]
xor edx, edx
call fcn.1400345b0
mov r8, r15
lea rcx, [rbp + 0x7a0]
xor edx, edx
call fcn.1400345b0
lea r8, [rbp + 0x170]
mov rdx, r14
lea rcx, [rbp + 0x7a0]
call fcn.14003b7c4
lea r8, [rsp + 0x4c]
mov rdx, r14
lea rcx, [rbp + 0x7a0]
call fcn.14003b744
lea r8, [rbp + 0x380]
mov rdx, r14
lea rcx, [rbp + 0x590]
call fcn.14003b7c4
lea r8, [rsp + 0x4c]
mov rdx, r14
lea rcx, [rbp + 0x590]
call fcn.14003b744
mov rdx, r14
lea rcx, [rbp + 0x590]
call fcn.14003bb10
lea rdx, str..cab
lea rcx, [rbp + 0x590]
call fcn.1400356dc
test rax, rax
je 0x14000bc31
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14000bc31
lea r8d, [rax + 1]
lea rdx, [rbp + 0x7a0]
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne sil
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000bc4c
test sil, sil
jne 0x14000bb5a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, sil
jmp 0x14000bc5c
xor al, al
mov rcx, qword [rbp + 0xbc0]
xor rcx, rsp
call fcn.140033470
mov rbx, qword [rsp + 0xd10]
add rsp, 0xcd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret