joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002414
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140035008]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x60], rdi
lea r8d, [rdi + 0x60]
mov rcx, rdx
call fcn.1400013f0
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140002492
lea r8d, [rdi + 2]
mov rcx, rbx
call fcn.1400013f0
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140002492
call fcn.1400018d4
mov ebx, eax
jmp 0x1400025a2
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1400024b3
call fcn.1400018d4
jmp 0x140002591
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400024a9
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1400024ee
mov ebx, 0x8007000e
jmp 0x140002593
mov ecx, eax
test eax, eax
jne 0x1400024f9
mov rdx, rdi
jmp 0x140002510
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1400025da
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140002525
lea rcx, [rsp + 0x60]
call fcn.14000542c
jmp 0x14000252f
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x140002541
cmp qword [rsp + 0x60], rdi
je 0x1400024e4
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1400024a9
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140003280
mov ebx, eax
test rsi, rsi
je 0x1400025a2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x1400025b9
lea rcx, [rsp + 0x60]
call fcn.1400050f0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400237c0
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.1400017e8
int3
Function at 0x140004c74
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x50
cmp byte [0x140036169], 0
je 0x140004c93
or eax, 0xffffffff
jmp 0x140004db8
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov dword [rsp + 0x68], eax
mov ebx, eax
test eax, eax
jns 0x140004cc8
cmp eax, 0x80010106
jne 0x140004db6
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004db6
jmp 0x140004ccf
mov byte [0x140036322], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r8, [rsp + 0x68]
call fcn.140004f14
cmp al, 1
jne 0x140004da3
call fcn.1400050fc
mov ebx, eax
test eax, eax
jne 0x140004d46
lea edx, [rax + 1]
call fcn.140022078
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x140004d4a
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
call fcn.1400174ec
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x140004d14
test ebx, ebx
js 0x140004da7
mov rdi, qword [0x140035380]
xor ebx, ebx
mov rcx, qword [0x140035388]
jmp 0x140004d87
test ebx, ebx
jne 0x140004d8c
mov rax, qword [rdi]
test rax, rax
je 0x140004d83
mov rax, qword [rax + 0x20]
cmp dword [rax + 8], ebx
je 0x140004d83
mov ecx, dword [rax + 8]
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov rcx, qword [0x140035388]
mov ebx, eax
add rdi, 8
cmp rdi, rcx
jb 0x140004d5c
cmp byte [0x140036320], 0
je 0x140004da7
mov ecx, dword [0x14003631c]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004da7
mov ebx, dword [rsp + 0x68]
cmp byte [0x140036322], 0
je 0x140004db6
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400050fc
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov ebx, 1
mov rdi, qword [0x140035380]
mov rax, qword [0x140035388]
jmp 0x1400051b5
test ebx, ebx
js 0x1400052d7
mov rsi, qword [rdi]
test rsi, rsi
je 0x1400051b1
and qword [rsp + 0x40], 0
cmp qword [rsi + 0x10], 0
jne 0x14000514c
xor ebx, ebx
jmp 0x1400051b1
lea r8, [rsp + 0x40]
lea rdx, [0x140027a10]
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x10]
call qword [0x140026788]
mov ebx, eax
test eax, eax
js 0x140005193
mov rax, qword [rsi + 0x20]
add rax, 8
mov qword [rsp + 0x20], rax
mov r9d, 5
lea r8d, [r9 - 1]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsi]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400051aa
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140026788]
mov rax, qword [0x140035388]
add rdi, 8
cmp rdi, rax
jb 0x14000512b
test ebx, ebx
js 0x1400052d7
jne 0x1400052d0
cmp byte [0x140036320], 0
je 0x14000527d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140036310], rax
test rax, rax
jne 0x1400051f9
xor edi, edi
jmp 0x14000523c
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r9, [0x1400362c0]
lea r8, [0x140005460]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x14000523c
mov rcx, qword [0x140036310]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x140036310], rdi
test rdi, rdi
jne 0x140005248
mov ebx, 0x80004005
jmp 0x140005289
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
test eax, eax
jns 0x140005272
mov rcx, qword [0x140036310]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [0x140036318]
add edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005285
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
test ebx, ebx
jns 0x1400052d7
xor eax, eax
mov rdi, qword [0x140035380]
mov rcx, qword [0x140035388]
jmp 0x1400052c9
test eax, eax
jne 0x1400052d7
mov rdx, qword [rdi]
test rdx, rdx
je 0x1400052c5
mov rax, qword [rdx + 0x20]
mov edx, dword [rax + 8]
test edx, edx
jne 0x1400052b6
xor eax, eax
jmp 0x1400052c5
mov ecx, edx
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov rcx, qword [0x140035388]
add rdi, 8
cmp rdi, rcx
jb 0x14000529b
jmp 0x1400052d7
mov byte [0x140036320], 0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140005578
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
and qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000000
lea rdx, str.CLSID
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005645
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and qword [rbp + 0x28], 0
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005636
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rdx, str.InsecureQI
lea rax, [rbp + 0x20]
mov dword [rbp + 0x18], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005636
cmp dword [rbp + 0x18], 4
jne 0x140005636
mov ebx, dword [rbp + 0x20]
cmp ebx, 3
ja 0x140005636
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140005647
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140005647
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140005645
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140005656
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140005a00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp byte [0x1400361a0], 0
je 0x140005a26
mov eax, dword [0x1400361a4]
jmp 0x140005b2b
and qword [rbp + 0x18], 0
lea rax, [rbp + 0x18]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftSecurity
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 4
lea rsi, [0x1400361a4]
test eax, eax
jne 0x140005a92
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.CLSIDInterfaceTest
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rbp + 0x10], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005a92
cmp dword [rbp + 0x10], ebx
je 0x140005b01
mov rcx, qword [rbp + 0x18]
and qword [rbp + 0x18], 0
test rcx, rcx
je 0x140005aa6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x18]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftSecurity
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005b09
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.CLSIDInterfaceTest
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rbp + 0x10], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005b09
cmp dword [rbp + 0x10], ebx
jne 0x140005b09
mov ebx, dword [0x1400361a4]
jmp 0x140005b12
and dword [0x1400361a4], 0
xor ebx, ebx
mov rcx, qword [rbp + 0x18]
mov al, 1
mov byte [0x1400361a0], al
test rcx, rcx
je 0x140005b29
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret

Function at 0x1400062cc
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x140035008]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14000636f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rcx, [rsp + 0x20]
call fcn.140008d00
lea ecx, [rax - 3]
movsxd rdx, ecx
lea r8, [rsp + 0x20]
lea r8, [r8 + rdx*2]
lea rdx, [rsp + 0x20]
cmp eax, 3
cmovg rdx, r8
lea r9, [rsp + 0x250]
xor r8d, r8d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x14000636f
lea rdx, [rsp + 0x250]
mov rcx, rbx
call fcn.140008488
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400237c0
add rsp, 0x470
pop rbx
ret
mov ecx, 0x13cb407
call fcn.140007f74
int3
Function at 0x1400105bc
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x10], 0
mov rdi, rcx
je 0x1400105dd
mov byte [rcx + 0x10], 0
add rcx, 8
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp byte [rdi + 0x10], 0
je 0x1400105f0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x1400105f9
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], rax
mov rax, qword gs:[0x58]
mov edx, 8
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140036238], eax
jg 0x140010664
mov rax, qword [rsp + 0x30]
xorps xmm0, xmm0
sub rax, qword [rdi]
cqo
idiv qword [0x140036230]
imul rcx, rax, 0x989680
test rcx, rcx
js 0x14001063c
cvtsi2sd xmm0, rcx
jmp 0x140010651
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
divsd xmm0, qword [0x14002d4c0]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x140036238]
call fcn.140023938
cmp dword [0x140036238], 0xffffffff
jne 0x140010615
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x38]
lea rcx, [0x140036238]
mov qword [0x140036230], rax
call fcn.1400238d8
jmp 0x140010615

Function at 0x14001357c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor edx, edx
mov rbx, rcx
call fcn.1400156fc
mov dword [rsp + 0x58], eax
mov edx, eax
test eax, eax
js 0x140013696
xor r9d, r9d
mov byte [rbx + 0x40], 1
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x78], rax
test rax, rax
jne 0x1400135dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
mov dword [rsp + 0x58], edx
test edx, edx
js 0x140013696
lea rax, [rbx + 0x70]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140014360]
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x68], rax
test rax, rax
jne 0x140013624
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
mov dword [rsp + 0x58], edx
test edx, edx
js 0x140013696
mov rax, qword [rbx + 0x68]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x78]
or r9d, 0xffffffff
mov qword [rsp + 0x38], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140013671
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
mov dword [rsp + 0x58], edx
test edx, edx
js 0x140013696
jmp 0x140013675
mov edx, dword [rsp + 0x58]
test edi, edi
jne 0x140013696
mov rcx, qword [rbx + 0x68]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [rsp + 0x58]
mov ecx, 0x9e969008
test eax, eax
cmove edx, ecx
mov rbx, qword [rsp + 0x50]
mov eax, edx
add rsp, 0x40
pop rdi
ret
Function at 0x140018a9c
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
xor esi, esi
mov rcx, qword [rcx]
cmp word [rcx], si
je 0x140018ae6
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx]
sub rcx, 0xc
cmp dword [rcx + 4], esi
je 0x140018adc
cmp dword [rcx], 1
je 0x140018ad6
or eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140018adc
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1110]
lea rcx, [0x140028ff4]
mov qword [rbx], rcx
add rcx, 0xfffffffffffffff4
cmp dword [rcx + 4], esi
je 0x140018b06
cmp dword [rcx], 1
je 0x140018b00
or eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140018b06
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1110]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x14001979c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x28]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x1400197dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140019873
lea rax, [rdi + 8]
mov dword [rdi + 0xc], 1
mov qword [rsp + 0x28], rax
lea r8, [0x140019940]
and dword [rsp + 0x20], 0
mov r9, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi], rax
test rax, rax
jne 0x140019822
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140019873
mov rax, qword [rdi]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rax, qword [rsi + 0x28]
or r9d, 0xffffffff
mov qword [rsp + 0x38], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
jne 0x140019868
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14001986f
test eax, eax
jne 0x14001986f
mov ebx, dword [rdi + 0xc]
test ebx, ebx
jns 0x14001987e
or edx, 0xffffffff
mov rcx, rdi
call fcn.1400198bc
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14001b7d0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x30]
test eax, eax
je 0x14001b7f2
cmp eax, 5
jne 0x14001b81e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x4000
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
je 0x14001b81e
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x90]
test rcx, rcx
je 0x14001b83a
call fcn.140019398
test eax, eax
js 0x14001b8b0
mov byte [rbx + 0xe3], 1
movabs rax, 0x7fffffffffffffff
mov qword [rbx + 0xd0], rax
mov rax, qword [rbx + 0x78]
test rax, rax
je 0x14001b85b
mov dword [rax + 0x40], 1
cmp byte [rbx + 0xe7], 0
mov rcx, rbx
je 0x14001b87c
mov byte [rbx + 0xe7], 0
call fcn.14001c4d8
mov byte [rbx + 0xe3], 0
jmp 0x14001b8aa
mov rax, qword [rbx]
mov rax, qword [rax + 0x10]
call qword [0x140026788]
xor r9d, r9d
mov byte [rsp + 0x20], 0
mov r10, rax
xor edx, edx
mov rcx, qword [rax]
lea r8d, [r9 + 4]
mov rax, qword [rcx + 0x40]
mov rcx, r10
call qword [0x140026788]
add rsp, 0x60
pop rbx
ret
mov edx, 0x235e119b
mov ecx, eax
call fcn.14000810c
int3
Function at 0x14001b8c0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 0x78]
mov dil, dl
mov rbx, rcx
test rax, rax
je 0x14001b8dd
and dword [rax + 0x40], 0
cmp qword [rcx + 0x90], 0
je 0x14001b9e9
mov byte [rcx + 0xe5], 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x20]
test eax, eax
je 0x14001b90b
cmp eax, 5
jne 0x14001b930
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rbx, qword [rbx + 0x90]
test dil, dil
je 0x14001b981
cmp byte [rbx + 0x50], 0
je 0x14001b962
lea rcx, [rbx + 0x40]
or edx, 0xffffffff
call fcn.1400198bc
test eax, eax
jns 0x14001b962
movsxd r8, eax
mov edx, 0x8002
mov rcx, rbx
call fcn.140019890
mov edx, 0x8003
mov r8d, 5
mov rcx, rbx
call fcn.140019890
mov ecx, 0xc6ff
call fcn.140021e10
jmp 0x14001b9e9
cmp byte [rbx + 0x50], 0
je 0x14001b9e9
lea rcx, [rbx + 0x40]
or edx, 0xffffffff
call fcn.1400198bc
mov ecx, 0xc6ff
movsxd rdi, eax
call fcn.140021e10
test edi, edi
jns 0x14001b9b4
mov r8, rdi
mov edx, 0x8002
mov rcx, rbx
call fcn.140019890
mov edx, 0x8003
mov r8d, 3
mov rcx, rbx
call fcn.140019890
test edi, edi
js 0x14001b9db
xor r8d, r8d
mov edx, 0x8001
mov rcx, rbx
call fcn.140019890
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x60]
call fcn.140006014
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14001d23c
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
cmp byte [rcx + 0xe2], 0
je 0x14001d2ca
cmp byte [rcx + 0xe0], 0
jne 0x14001d2ca
mov rdi, qword [rcx + 0x90]
and dword [rax + 8], 0
and dword [rax + 0xc], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rax + 8]
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14001d2ca
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 0x20]
call fcn.140006014
test al, al
je 0x14001d2ca
mov rax, qword [rsp + 0x38]
add rax, 0x600000
cmp rax, qword [rsp + 0x30]
jbe 0x14001d2ca
mov rcx, rbx
call fcn.14001c4d8
mov edx, 0xb4153c98
mov r9d, 0x30
mov r8d, 0xc1715bb4
mov rcx, rbx
call fcn.14001d12c
nop
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140021684
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140035008]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov r8, rcx
or rdi, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov r9, rdi
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea edx, [rdi + 0x5d]
lea rcx, [rsp + 0x20]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
lea rdx, [rsp + 0x228]
mov r9, rdi
add rax, 2
mov r8, rbx
sub rdx, rax
mov rcx, rax
sar rdx, 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
xor r8d, r8d
lea rcx, [rsp + 0x20]
call fcn.14001f4bc
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x14002170a
mov eax, ebx
jmp 0x140021710
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1400364ec], eax
test rdi, rdi
je 0x14002171f
mov eax, ebx
jmp 0x14002172a
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [0x1400364e8], eax
cmp eax, 0xffffffff
jne 0x14002173d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x1400364e4], ebx
mov rax, rdi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400237c0
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret
Function at 0x140021768
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140035008]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
mov dword [rsp + 0x40], 0x208
lea rax, [rsp + 0x40]
mov rdi, rcx
mov qword [rsp + 0x30], rax
lea r8, str.CommonFilesDir
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea esi, [rbx + 2]
mov r9d, esi
mov qword [rsp + 0x20], rbx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14002181b
cmp dword [rsp + 0x40], 4
jb 0x14002181b
mov eax, dword [rsp + 0x40]
lea r8, str.Microsoft_SharedOffice16_
shr rax, 1
lea rcx, [rsp + 0x50]
mov edx, 0x104
cmp word [rsp + rax*2 + 0x4c], 0x5c
cmove ebx, esi
or r9, 0xffffffffffffffff
add r8, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140021684
jmp 0x14002181d
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400237c0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140021844
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x140035008]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x30], rax
lea rdx, str.SoftwareMicrosoftOffice16.0CommonFilesPaths
lea rax, [rsp + 0x50]
mov rbx, rcx
mov r8, rcx
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, 2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400218bb
cmp dword [rsp + 0x40], 4
jb 0x1400218bb
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140021684
jmp 0x1400218bd
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400237c0
add rsp, 0x270
pop rbx
ret