joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a820
Capabilities:
Get file version info

Disassembly:
push rbx
push rsi
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x14001a834
mov rbx, qword [rcx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
jne 0x14001a851
xor eax, eax
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rsi
mov edx, 1
mov qword [rsp + 0x20], rdi
call fcn.140094790
mov rdi, rax
test rax, rax
je 0x14001a94a
mov edx, dword [rsp + 0x40]
mov r9, rax
mov r8d, esi
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov rcx, rdi
test eax, eax
je 0x14001a945
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
lea rdx, str.VarFileInfoTranslation
xor esi, esi
mov qword [rsp + 0x58], rsi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14001a942
cmp qword [rsp + 0x58], rsi
je 0x14001a942
lea ecx, [rsi + 0x20]
call fcn.140091088
mov rbx, rax
test rax, rax
je 0x14001a930
mov rcx, qword [rsp + 0x58]
lea rax, [0x1400c44d0]
movzx r8d, word [rcx + 2]
movzx edx, word [rcx]
mov qword [rbx], rax
mov qword [rbx + 8], rsi
mov word [rbx + 0x10], dx
mov word [rbx + 0x12], r8w
mov rcx, qword [rbx + 8]
mov qword [rbx + 8], rdi
test rcx, rcx
je 0x14001a904
call fcn.140091c58
mov rcx, qword [rbx + 8]
lea r8, [rbx + 0x18]
lea r9, [rsp + 0x50]
lea rdx, [0x1400c4240]
mov qword [r8], rsi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov rdi, qword [rsp + 0x20]
mov rax, rbx
add rsp, 0x28
pop rsi
pop rbx
ret
mov rdi, qword [rsp + 0x20]
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rdi
call fcn.140091c58
xor eax, eax
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
Function at 0x14001abc0
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
movzx eax, word [rcx + 0x10]
mov r15, r8
mov r14, rdx
mov word [rsp + 0x50], ax
movzx eax, word [rcx + 0x12]
mov rbp, rcx
mov word [rsp + 0x52], ax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ebx, 0x4e4
mov word [rsp + 0x54], ax
movzx eax, word [rbp + 0x12]
mov word [rsp + 0x5a], bx
mov word [rsp + 0x56], ax
movzx eax, word [rbp + 0x10]
mov word [rsp + 0x58], ax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [rsp + 0x5e], bx
xor ebx, ebx
lea rdi, [rsp + 0x50]
mov word [rsp + 0x5c], ax
mov esi, ebx
movzx eax, word [rdi + 2]
movzx edx, word [rdi]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
mov edx, 0x104
lea r9, str.StringFileInfo_04x_04x_ls
lea rcx, [rsp + 0x60]
mov r8d, edx
add esi, 2
lea rdi, [rdi + 4]
call fcn.1400947d4
mov rcx, qword [rbp + 8]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x40], rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14001aca0
mov rdx, qword [rsp + 0x40]
test rdx, rdx
jne 0x14001acd2
movsxd rax, esi
cmp rax, 8
jb 0x14001ac40
xor al, al
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140091a70
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x280
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
cmp word [rdx], bx
je 0x14001acea
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14001ace0
mov r8, rbx
mov rcx, r15
call fcn.140008160
mov al, 1
jmp 0x14001acab
Function at 0x14001ae00
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0x104
mov rdi, rdx
mov rbx, rcx
jae 0x14000ec73
cmp qword [rdx + 0x10], 0x104
jae 0x14000ec73
cmp qword [rdx + 0x18], 8
jb 0x14000ebb6
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x14000ebc0
mov rcx, qword [rcx]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14000ebdd
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
xor sil, sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbx + 0x18], 8
mov ebp, eax
jb 0x14000ebfe
mov rcx, qword [rbx]
jmp 0x14000ec01
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000ec52
shr eax, 4
and al, 1
je 0x14000ec52
mov r8b, 1
mov rdx, rdi
mov rcx, rbx
call fcn.14000d3e0
test al, al
je 0x14000ec4f
mov dl, 1
mov rcx, rbx
call fcn.14000d1e0
test al, al
je 0x14000ec4f
mov rbp, qword [rsp + 0x38]
mov sil, 1
movzx eax, sil
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor sil, sil
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x38]
movzx eax, sil
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140005ac0
test al, al
jne 0x14001ae3a
mov rcx, rbx
call fcn.140005ac0
test al, al
jne 0x14001ae3a
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14000eb80
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b260
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r15
sub rsp, 0x28
xor ebp, ebp
mov r15, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x14001b290
cmp qword [rdx + 0x18], 0x10
mov qword [rdx + 0x10], rbp
jb 0x14001b28a
mov rax, qword [rdx]
jmp 0x14001b28d
mov rax, rdx
mov byte [rax], bpl
call fcn.140005ac0
test al, al
je 0x14001b2a5
xor al, al
add rsp, 0x28
pop r15
pop rsi
pop rbp
pop rbx
ret
mov rcx, rbx
mov qword [rsp + 0x20], r14
call fcn.14000e530
mov r14, rax
test rax, rax
jne 0x14001b2c9
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x10000
mov qword [rsp + 0x50], rdi
call fcn.140090614
mov r9, r14
mov edx, 1
mov rcx, rax
mov r8d, 0x10000
mov rbx, rax
call fcn.140095210
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14001b360
nop
test rsi, rsi
je 0x14001b32f
lea rax, [rsp + 0x58]
mov rcx, r15
lea r8, [rsp + 0x68]
sub rcx, rbp
mov rdx, rbx
cmp rcx, rdi
mov qword [rsp + 0x68], rcx
mov rcx, rsi
cmovae r8, rax
mov r8, qword [r8]
call fcn.1400072b0
mov rax, r15
sub rax, rbp
cmp rax, rdi
jb 0x14001b371
mov r9, r14
mov edx, 1
mov r8d, 0x10000
mov rcx, rbx
add rbp, rdi
call fcn.140095210
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x14001b300
mov rcx, r14
call fcn.140095388
test eax, eax
jne 0x14001b371
mov dil, 1
jmp 0x14001b374
xor dil, dil
mov rcx, r14
call fcn.140095740
test rbx, rbx
je 0x14001b389
mov rcx, rbx
call fcn.140091c98
mov r14, qword [rsp + 0x20]
movzx eax, dil
mov rdi, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001b3b0
Capabilities:
Read file on windows

Disassembly:
or r8, 0xffffffffffffffff
jmp fcn.14001b260
Function at 0x14001c510
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp qword [rcx + 0x78], 0
mov rdi, rcx
je 0x14001c723
cmp byte [rcx + 0x81], 0
je 0x14001c723
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x14001c558
xor al, al
jmp 0x14001c710
xor ecx, ecx
mov edx, 0xf
mov qword [rsp + 0x90], rsi
cmp rdx, 0x10
mov byte [rbp - 0x30], 0
mov qword [rsp + 0x60], r14
lea rax, [rbp - 0x30]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x30], rcx
cmovae rax, rcx
mov qword [rbp - 0x20], 8
mov qword [rsp + 0x88], rbx
mov byte [rax + 8], cl
xor r14d, r14d
mov r9, qword [rbp - 0x18]
nop
mov rcx, qword [rdi + 0x78]
cmp r9, 0x10
mov r9, qword [rbp - 0x20]
mov r10, qword [rcx]
lea rax, [rbp - 0x38]
lea rdx, [rbp - 0x30]
cmovae rdx, qword [rbp - 0x30]
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], rax
cmovae r8, qword [rbp - 0x30]
add r9, rdx
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x14001c5f4
dec eax
je 0x14001c5fb
mov r9, qword [rbp - 0x18]
sub eax, 2
je 0x14001c6e7
xor bl, bl
jmp 0x14001c6e9
mov byte [rdi + 0x81], r14b
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x38]
cmp r9, 0x10
lea rax, [rbp - 0x30]
cmovae rax, r10
sub rbx, rax
je 0x14001c641
cmp r9, 0x10
mov r9, qword [rdi + 0x90]
lea rcx, [rbp - 0x30]
mov r8, rbx
mov edx, 1
cmovae rcx, r10
call fcn.140092b18
mov r9, qword [rbp - 0x18]
cmp rbx, rax
jne 0x14001c5ed
cmp byte [rdi + 0x81], r14b
je 0x14001c6e7
test rbx, rbx
jne 0x14001c5a0
mov r8, qword [rbp - 0x20]
or rax, 0xffffffffffffffff
sub rax, r8
cmp rax, 8
jbe 0x14001c734
lea rbx, [r8 + 8]
cmp rbx, 0xfffffffffffffffe
ja 0x14001c727
cmp r9, rbx
jae 0x14001c6c9
lea rcx, [rbp - 0x30]
mov rdx, rbx
call fcn.1400085a0
mov r9, qword [rbp - 0x18]
test rbx, rbx
je 0x14001c5a0
mov rax, qword [rbp - 0x20]
cmp r9, 0x10
lea rcx, [rbp - 0x30]
cmovae rcx, qword [rbp - 0x30]
xor edx, edx
mov qword [rax + rcx], rdx
cmp qword [rbp - 0x18], 0x10
lea rax, [rbp - 0x30]
cmovae rax, qword [rbp - 0x30]
mov qword [rbp - 0x20], rbx
mov byte [rbx + rax], dl
jmp 0x14001c59a
test rbx, rbx
jne 0x14001c698
lea rax, [rbp - 0x30]
cmp r9, 0x10
mov qword [rbp - 0x20], r14
cmovae rax, qword [rbp - 0x30]
mov byte [rax], r14b
jmp 0x14001c59a
mov bl, 1
cmp r9, 0x10
jb 0x14001c6f8
mov rcx, qword [rbp - 0x30]
call fcn.1400910f4
mov rsi, qword [rsp + 0x90]
mov r14, qword [rsp + 0x60]
movzx eax, bl
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140091a70
add rsp, 0x68
pop rdi
pop rbp
ret
mov al, 1
jmp 0x14001c710
lea rcx, str.string_too_long
call fcn.140090454
int3
lea rcx, str.string_too_long
call fcn.140090454
int3
Function at 0x14001d410
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
movzx r9d, byte [r8]
mov rbx, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, rdx
mov rdx, qword [rbx + 0x28]
xor r9, rax
movzx eax, byte [r8 + 1]
mov r10, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, r9
shr rcx, 0x20
xor rcx, r9
and rcx, rdx
cmp qword [rbx + 0x30], rcx
ja 0x14001d485
shr rdx, 1
or rax, 0xffffffffffffffff
sub rax, rdx
add rcx, rax
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx]
mov rax, rcx
add rax, rax
add rcx, rcx
mov r9, qword [r8 + rcx*8]
mov rax, qword [r8 + rax*8]
lea r8, [r8 + rcx*8]
cmp r9, rdx
jne 0x14001d4ab
mov rcx, rdx
jmp 0x14001d4b2
mov rcx, qword [r8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14001d4ea
mov ecx, dword [r10]
cmp dword [rax + 0x10], ecx
je 0x14001d4c4
mov rax, qword [rax]
jmp 0x14001d4a1
mov ecx, dword [rax + 0x10]
mov qword [rsp + 8], rdx
cmp dword [r10], ecx
jne 0x14001d4d6
mov qword [rsp + 8], rax
lea rax, [rsp + 8]
mov rax, qword [rax]
mov qword [r11], rax
mov rax, r11
mov rbx, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 0x10]
mov qword [r11], rdx
mov rax, r11
ret
Function at 0x14001d900
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
mov r11, r8
movabs rax, 0xcbf29ce484222325
xor r9, rax
movzx eax, byte [r8 + 1]
mov rsi, rdx
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x28]
mov r8, r9
shr r8, 0x20
xor r8, r9
and r8, rcx
cmp qword [r10 + 0x30], r8
ja 0x14001d982
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add r8, rax
mov rcx, qword [r10 + 0x10]
mov rbx, qword [r10]
shl r8, 4
mov rax, qword [rcx + r8]
cmp rbx, rax
je 0x14001d9b4
mov rbx, qword [rcx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14001d9b4
mov ecx, dword [r11]
mov rbx, qword [rbx + 8]
cmp dword [rbx + 0x10], ecx
je 0x14001da06
cmp rbx, rax
jne 0x14001d9a6
mov rax, qword [rdi]
cmp rbx, rax
je 0x14001d9e9
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x10]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10]
jne 0x14001da2b
mov qword [rdx], rdi
mov rax, qword [r10 + 0x10]
mov qword [r8 + rax + 8], rdi
jmp 0x14001da57
mov rdx, rdi
mov rcx, r10
call fcn.14001da80
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp rax, rbx
jne 0x14001da35
mov qword [rdx], rdi
jmp 0x14001da57
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14001da57
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.14001dae0
mov rbx, qword [rsp + 0x30]
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001dcd0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
xor r8d, r8d
movabs rbx, 0x7fffffffffffffff
mov dword [rsp + 0x48], r8d
mov rdi, rcx
cmp rdx, rbx
je 0x14001dd1a
movabs rax, 0x20c49ba5e353f7cf
imul rdx
mov rbx, rdx
sar rbx, 7
mov rax, rbx
shr rax, 0x3f
add rbx, rax
mov eax, r8d
mov edx, 0xffffffff
mov ecx, 2
cmp rbx, rdx
cmovle ecx, r8d
test rbx, rbx
sets al
or ecx, eax
je 0x14001dd55
dec ecx
je 0x14001dd52
dec ecx
je 0x14001dd4e
dec ecx
jne 0x14001dd55
cmp byte [0x1400d77dc], r8b
jne 0x14001ddc7
int3
mov ebx, edx
jmp 0x14001dd55
mov ebx, r8d
cmp byte [rdi], r8b
je 0x14001dd62
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14001dd66
mov rax, qword [rdi + 8]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001dd87
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi], 0
je 0x14001dd94
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14001dd98
mov rax, qword [rdi + 8]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14001dd75
test rsi, rsi
je 0x14001ddb5
mov eax, dword [rsp + 0x48]
mov dword [rsi], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov al, 1
add rsp, 0x20
pop rdi
ret
mov ecx, 1
call fcn.14009400c
int3
Function at 0x14001f600
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x50
xor edi, edi
mov rbx, r8
mov rsi, rdx
mov dword [rsp + 0x60], edi
test rcx, rcx
je 0x14001f661
lea rax, [r11 + 8]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
xor r9d, r9d
mov qword [r11 - 0x18], rax
lea rax, [r11 + 0x10]
xor r8d, r8d
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
mov qword [r11 + 0x10], rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001f661
mov rdi, qword [rsp + 0x68]
cmp qword [rbx + 0x18], 8
jb 0x14001f66b
mov rbx, qword [rbx]
cmp qword [rsi + 0x18], 8
jb 0x14001f675
mov rsi, qword [rsi]
or rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14001f680
lea eax, [rax*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
test rdi, rdi
je 0x14001f6c4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x78]
movzx eax, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x14001f6e0
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rdx
mov dword [rsp + 0x60], ebx
test rcx, rcx
je 0x14001f73a
lea rax, [r11 + 8]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
xor r9d, r9d
mov qword [r11 - 0x18], rax
lea rax, [r11 + 0x10]
xor r8d, r8d
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ebx
mov qword [r11 + 0x10], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001f73a
mov rbx, qword [rsp + 0x68]
cmp qword [rdi + 0x18], 8
jb 0x14001f744
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
sete dil
test rbx, rbx
je 0x14001f764
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400238b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
movsxd rbp, r9d
mov r12, r8
mov r15, rdx
mov r14, rcx
mov dword [rsp + 0x98], ebx
test r9d, r9d
jns 0x1400238e7
or eax, 0xffffffff
add rsp, 0x50
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
mov rcx, qword [0x1400d8cf0]
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
mov rdi, rbx
test rcx, rcx
je 0x14002393a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test al, al
je 0x14002393a
mov rcx, qword [0x1400d8cf0]
lea rdi, [r14 + 0x28]
lea rsi, str.File::Read
mov r10, qword [rcx]
lea r9, [r14 + 8]
mov r8, rdi
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [r10 + 0x20]
jmp 0x14002393f
mov rsi, qword [rsp + 0x38]
mov rcx, qword [r14]
xor eax, eax
lea r9, [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x40], r15d
shr r15, 0x20
mov r8d, ebp
mov rdx, r12
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], r15d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140023991
mov ebx, dword [rsp + 0x98]
jmp 0x14002399f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x14002399f
or ebx, 0xffffffff
test rdi, rdi
je 0x1400239bd
mov rcx, qword [0x1400d8cf0]
test rcx, rcx
je 0x1400239bd
mov r9, qword [rcx]
mov r8, rdi
mov rdx, rsi
call qword [r9 + 0x28]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov eax, ebx
add rsp, 0x50
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret

Function at 0x1400239e0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov dword [rsp + 0x50], 0
mov rcx, qword [0x1400d8cf0]
xor edi, edi
test rcx, rcx
je 0x140023a3f
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test al, al
je 0x140023a3f
mov rcx, qword [0x1400d8cf0]
lea rdi, [rbx + 0x28]
lea rsi, str.File::GetLength
mov rax, qword [rcx]
lea r9, [rbx + 8]
mov r8, rdi
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [rax + 0x20]
jmp 0x140023a44
mov rsi, qword [rsp + 0x38]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rbx, qword [rsp + 0x50]
or rcx, 0xffffffffffffffff
test eax, eax
cmove rbx, rcx
test rdi, rdi
je 0x140023a7f
mov rcx, qword [0x1400d8cf0]
test rcx, rcx
je 0x140023a7f
mov r9, qword [rcx]
mov r8, rdi
mov rdx, rsi
call qword [r9 + 0x28]
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140023aa0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov dword [rsp + 0x50], 0
mov rcx, qword [0x1400d8cf0]
xor edi, edi
mov qword [rsp + 0x58], rbp
mov rbp, rdx
test rcx, rcx
je 0x140023b03
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test al, al
je 0x140023b03
mov rcx, qword [0x1400d8cf0]
lea rdi, [rbx + 0x28]
lea rsi, str.File::SetLength
mov rax, qword [rcx]
lea r9, [rbx + 8]
mov r8, rdi
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [rax + 0x20]
jmp 0x140023b08
mov rsi, qword [rsp + 0x38]
mov rcx, qword [rbx]
lea r8, [rsp + 0x50]
mov r9d, 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140023b61
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140023b61
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140023b61
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140023b61
mov bl, 1
jmp 0x140023b63
xor bl, bl
mov rbp, qword [rsp + 0x58]
test rdi, rdi
je 0x140023b86
mov rcx, qword [0x1400d8cf0]
test rcx, rcx
je 0x140023b86
mov r9, qword [rcx]
mov r8, rdi
mov rdx, rsi
call qword [r9 + 0x28]
mov rsi, qword [rsp + 0x68]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140024430
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
or rdi, 0xffffffffffffffff
xor r12d, r12d
mov r14, r8
mov rsi, rdx
mov qword [rbp - 0x50], rdx
test rdx, rdx
jne 0x14002446d
mov eax, r12d
jmp 0x140024489
cmp byte [rdx], r12b
jne 0x140024477
mov rax, r12
jmp 0x140024489
mov rax, rdi
nop word [rax + rax]
inc rax
cmp byte [rdx + rax], r12b
jne 0x140024480
mov qword [rbp - 0x48], rax
movaps xmm0, xmmword [rbp - 0x50]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
movdqa xmmword [rbp - 0x50], xmm0
call fcn.140012490
cmp qword [rax + 0x18], 8
jb 0x1400244ad
mov rax, qword [rax]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp qword [rbp - 0x18], 8
mov r15d, eax
jb 0x1400244ce
mov rcx, qword [rbp - 0x30]
call fcn.1400910f4
test r15d, r15d
jne 0x1400244da
xor al, al
jmp 0x140024629
test r14, r14
je 0x140024627
mov eax, 2
mov qword [rsp + 0xa0], rbx
mul r15
cmovo rax, rdi
mov rcx, rax
call fcn.140090614
mov qword [rbp - 0x50], rsi
mov rbx, rax
test rsi, rsi
jne 0x140024510
mov rax, r12
jmp 0x140024529
cmp byte [rsi], r12b
jne 0x14002451a
mov rax, r12
jmp 0x140024529
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rsi + rax], r12b
jne 0x140024520
mov qword [rbp - 0x48], rax
movaps xmm0, xmmword [rbp - 0x50]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
movdqa xmmword [rbp - 0x50], xmm0
call fcn.140012490
cmp qword [rax + 0x18], 8
jb 0x14002454d
mov rax, qword [rax]
mov r8d, r15d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp qword [rbp - 0x18], 8
jb 0x14002456c
mov rcx, qword [rbp - 0x30]
call fcn.1400910f4
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r12
mov word [rbp - 0x50], r12w
cmp word [rbx], r12w
jne 0x140024590
mov rdi, r12
jmp 0x14002459a
inc rdi
cmp word [rbx + rdi*2], r12w
jne 0x140024590
lea rcx, [rbp - 0x50]
mov r8, rdi
mov rdx, rbx
call fcn.140008160
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400122a0
mov rdi, rax
cmp r14, rax
je 0x1400245e7
cmp qword [r14 + 0x18], 0x10
jb 0x1400245cd
mov rcx, qword [r14]
call fcn.1400910f4
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], r12
mov rdx, rdi
mov rcx, r14
mov byte [r14], r12b
call fcn.140007110
cmp qword [rbp - 0x18], 0x10
jb 0x1400245f7
mov rcx, qword [rbp - 0x30]
call fcn.1400910f4
cmp qword [rbp - 0x38], 8
mov qword [rbp - 0x18], 0xf
mov qword [rbp - 0x20], r12
mov byte [rbp - 0x30], r12b
jb 0x140024617
mov rcx, qword [rbp - 0x50]
call fcn.1400910f4
mov rcx, rbx
call fcn.140091c98
mov rbx, qword [rsp + 0xa0]
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140091a70
mov rsi, qword [rsp + 0xa8]
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret