joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003e084
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
call fcn.14003e1c4
xor r14d, r14d
mov esi, 1
mov rbp, rax
mov dword [rbx + 0x14], esi
mov rcx, rax
cmp dword [rbx], r14d
je 0x14003e139
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rbx, eax
test eax, eax
js 0x14003e15c
mov rcx, qword [rdi]
mov edx, dword [rcx - 0xc]
sub esi, dword [rcx - 8]
sub edx, ebx
or esi, edx
jge 0x14003e0e8
mov edx, ebx
mov rcx, rdi
call fcn.140002db4
mov rdx, qword [rdi]
cmp ebx, dword [rdx - 0xc]
jg 0x14003e15c
mov dword [rdx - 0x10], ebx
lea r8d, [rbx + 1]
mov rax, qword [rdi]
mov rcx, rbp
mov word [rax + rbx*2], r14w
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14003e115
mov eax, r14d
jmp 0x14003e122
movsxd rdx, dword [rcx - 0xc]
call fcn.1401c4dd0
test eax, eax
js 0x14003e15c
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x14003e15c
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], r14w
jmp 0x14003e141
mov rdx, qword [rdi]
call fcn.140053594
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, 0x80070057
call fcn.140002f6c
int3

Function at 0x14003e218
Capabilities:
Get graphical window text

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0xd0
mov rax, qword [0x140287940]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbp, r8
lea r15, [r11 + 0x28]
mov rdi, rcx
call fcn.14003e1c4
cmp dword [rdi], 0
mov rsi, rax
mov dword [rdi + 0x14], 1
je 0x14003e2ad
mov rbx, qword [r15]
lea rdx, [rsp + 0x40]
mov r8d, 0x40
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r9, rbx
lea rcx, [rsp + 0x40]
mov r8, rbp
mov edx, 0x40
call fcn.14003e368
cmp eax, 1
je 0x14003e326
mov ecx, dword [rsp + 0x118]
or r8d, 0xffffffff
xor edx, edx
call fcn.140037ff0
mov rcx, rdi
call fcn.14003e168
jmp 0x14003e326
call fcn.1401c13f0
mov ebx, dword [rax]
call fcn.1401c13f0
and dword [rax], 0
call fcn.140006354
mov r9d, 0x3f
mov qword [rsp + 0x30], r15
and qword [rsp + 0x28], 0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, qword [rax]
lea r8d, [r9 + 1]
call fcn.1401c4384
call fcn.1401c13f0
cmp dword [rax], 0
je 0x14003e312
call fcn.1401c13f0
cmp dword [rax], 0
je 0x14003e319
cmp dword [rax], 0xc
je 0x14003e35a
cmp dword [rax], 0x16
je 0x14003e34f
cmp dword [rax], 0x22
je 0x14003e34f
cmp dword [rax], 0x50
jne 0x14003e344
jmp 0x14003e319
call fcn.1401c13f0
mov dword [rax], ebx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140053594
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401bbe60
add rsp, 0xd0
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140002f6c
int3
mov ecx, 0x80070057
call fcn.140002f6c
int3
mov ecx, 0x8007000e
call fcn.140002f6c
int3
Function at 0x1400410b4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r9
mov r15, r8
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140041175
mov esi, 0x811c9dc5
xor ebx, ebx
mov rcx, rdx
call fcn.1401c4ca4
mov r8, rax
mov eax, 0xcccccccd
mul r8d
shr edx, 3
inc edx
test r8d, r8d
je 0x140041118
movzx ecx, word [rdi + rbx*2]
imul esi, esi, 0x1000193
xor esi, ecx
add ebx, edx
cmp ebx, r8d
jb 0x140041105
mov dword [r14], esi
xor edx, edx
mov eax, esi
div dword [rbp + 0x10]
mov dword [r15], edx
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x14004115a
mov rbx, qword [rbx + rdx*8]
test rbx, rbx
je 0x14004115a
mov eax, dword [r14]
cmp dword [rbx + 8], eax
jne 0x140041150
mov rdx, rdi
mov rcx, qword [rbx + 0x10]
call fcn.1401d0614
nop
test eax, eax
je 0x140041155
mov rbx, qword [rbx]
jmp 0x140041132
mov rax, rbx
jmp 0x14004115c
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
call fcn.14001ec08
int3

Function at 0x140043248
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rdx
mov rbp, rcx
call fcn.14002a288
mov r8d, 0xf1
mov rdx, r14
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r15d, r15d
test rax, rax
je 0x140043359
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140043359
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140043359
movzx ecx, word [rax + 6]
lea eax, [r15 + 4]
mul rcx
lea rcx, [r15 - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.1400064a8
mov rsi, rax
mov r9d, r15d
movzx eax, word [rbx + 6]
cmp r15w, ax
jae 0x1400432fb
mov rdx, rsi
lea r8, [rbx + 8]
movzx ecx, word [r8]
inc r9d
mov dword [rdx], ecx
lea r8, [r8 + 2]
movzx eax, word [rbx + 6]
lea rdx, [rdx + 4]
cmp r9d, eax
jl 0x1400432e1
movzx r8d, ax
mov rdx, rsi
mov rcx, rbp
call fcn.140043b88
mov rcx, rsi
mov edi, eax
call fcn.140002c88
test edi, edi
je 0x140043355
movzx ecx, word [rbx + 4]
movzx eax, word [rbx + 2]
mov dword [rsp + 0x60], eax
add eax, 7
mov dword [rsp + 0x68], eax
lea eax, [rcx + 7]
mov dword [rsp + 0x64], ecx
mov r8, qword [rsp + 0x60]
mov rcx, rbp
mov dword [rsp + 0x6c], eax
mov rdx, qword [rsp + 0x68]
call fcn.140043d90
mov rdx, r14
mov rcx, rbp
call fcn.1400431cc
mov edi, eax
mov eax, edi
jmp 0x14004335b
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004b15c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rdi, r9
mov rbx, r8
and qword [r9], 0
mov r14, qword [rbp + 0x40]
and dword [r14], 0
cmp qword [rcx + 0xb0], 0
je 0x14004b234
xor r8d, r8d
call fcn.14004b5d4
mov rsi, rax
test rax, rax
je 0x14004b2e3
mov qword [rbp - 0x20], rsi
and dword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and dword [rbp + 0x20], 0
and dword [rbp + 0x40], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x40]
mov dword [r14], ecx
test eax, eax
jne 0x14004b218
call fcn.1400064a8
mov qword [rdi], rax
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004b218
lea ebx, [rax + 1]
jmp 0x14004b226
mov rcx, qword [rdi]
call fcn.140002c88
and qword [rdi], 0
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004b2e1
mov rax, qword [rcx]
and qword [rsp + 0x20], 0
mov r9, rbx
mov r8, rdx
lea rdx, [rbp + 0x40]
mov rax, qword [rax + 0x108]
call qword [case.0x14007cb16.0]
nop
mov rax, qword [rbp + 0x40]
mov ecx, dword [rax - 0x10]
test ecx, ecx
jne 0x14004b264
xor ebx, ebx
jmp 0x14004b2c0
shr ecx, 1
mov dword [r14], ecx
call fcn.1400064a8
mov qword [rdi], rax
xor r8d, r8d
lea ebx, [r8 + 1]
cmp dword [r14], r8d
jbe 0x14004b2bc
lea ecx, [r8 + r8]
lea edx, [rcx + 1]
test edx, edx
js 0x14004b2f8
mov rax, qword [rbp + 0x40]
cmp edx, dword [rax - 0x10]
jg 0x14004b2f8
movsxd r9, ecx
movzx edx, word [rax + r9*2 + 2]
test ecx, ecx
js 0x14004b2f8
cmp ecx, dword [rax - 0x10]
jg 0x14004b2f8
shl dl, 4
sub dl, 0x51
add dl, byte [rax + r9*2]
mov rax, qword [rdi]
mov byte [r8 + rax], dl
add r8d, ebx
cmp r8d, dword [r14]
jb 0x14004b27d
mov rax, qword [rbp + 0x40]
lea rdx, [rax - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14004b2e1
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14007cb16.0]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140002f6c
int3
Function at 0x14004b304
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14004b37f
xor r8d, r8d
call fcn.14004b5d4
mov rsi, rax
test rax, rax
je 0x14004b37b
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14004b37b
mov eax, dword [rsp + 0x30]
jmp 0x14004b395
mov eax, edi
jmp 0x14004b395
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14004b3a8
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f68]
mov eax, 0x2068
call fcn.1401bc630
sub rsp, rax
mov rax, qword [0x140287940]
xor rax, rsp
mov qword [rbp + 0x1f50], rax
mov r12, r9
mov r10, r8
mov rdi, rdx
mov r14, qword [rbp + 0x1fd0]
mov qword [rsp + 0x38], rdx
xor r13d, r13d
cmp qword [rcx + 0xb0], r13
je 0x14004b555
xor r8d, r8d
mov rdx, r10
call fcn.14004b5d4
mov rsi, rax
test rax, rax
jne 0x14004b41b
mov rdx, r14
jmp 0x14004b58d
call fcn.14001dc98
mov rcx, rax
test rax, rax
je 0x14004b5c6
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14007cb16.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x30], r13d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
test eax, eax
jne 0x14004b4f1
mov edx, dword [rsp + 0x30]
shr edx, 1
lea ecx, [rax + 1]
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x14004b49a
lea rcx, [rsp + 0x38]
call fcn.140002db4
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
test rbx, rbx
jne 0x14004b4ca
mov eax, r13d
jmp 0x14004b4de
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1401c4dd0
test eax, eax
js 0x14004b5bb
cmp eax, dword [rbx - 0xc]
jg 0x14004b5bb
mov dword [rbx - 0x10], eax
mov eax, eax
mov word [rbx + rax*2], r13w
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15d, r15d
jne 0x14004b526
lea rcx, [rbx - 0x18]
call fcn.140003d1c
add rax, 0x18
mov qword [rdi], rax
or eax, 0xffffffff
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x14004b595
mov rcx, qword [rbx - 0x18]
lea rdx, [rbx - 0x18]
jmp 0x14004b546
mov rdx, r14
mov rcx, rdi
call fcn.14000e48c
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004b595
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14007cb16.0]
jmp 0x14004b595
lea r8, [0x140247208]
test r14, r14
cmovne r8, r14
mov rax, qword [rcx + 0xd8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x50]
mov rdx, r12
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14000e48c
mov rax, rdi
mov rcx, qword [rbp + 0x1f50]
xor rcx, rsp
call fcn.1401bbe60
add rsp, 0x2068
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.140002f6c
nop
mov ecx, 0x80004005
call fcn.140002f6c
int3
Function at 0x14004c73c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14004c7a3
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004c7b7
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004c7b7
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call qword [case.0x14007cb16.0]
jmp 0x14004c7bc
cmp dword [rcx + 8], 0
je 0x14004c7b7
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14004c7bc
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14004d944
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [rdx]
xor r15d, r15d
mov qword [rbp - 8], r15
mov rbx, rdx
mov edx, 0x104
mov rsi, rcx
mov edi, r15d
mov r8d, dword [rax - 0xc]
lea r9d, [r15 + 1]
sub r9d, dword [rax - 8]
sub r8d, edx
or r9d, r8d
jge 0x14004d98b
mov rcx, rbx
call fcn.140002db4
mov r14, qword [rbx]
lea rax, [rbp - 8]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x38], 0x208
lea rdx, str.CLSID
mov dword [rbp + 0x40], r15d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004da63
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x10], r15
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004da59
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x48]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x48], r15
lea rdx, str.InProcServer32
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004da4f
mov rcx, qword [rbp + 0x48]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [0x140247208]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x48]
test eax, eax
sete dil
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14004da70
mov eax, r15d
jmp 0x14004da7d
movsxd rdx, dword [rcx - 0xc]
call fcn.1401c4dd0
test eax, eax
js 0x14004daa5
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14004daa5
mov dword [rcx - 0x10], eax
mov rcx, qword [rbx]
mov rbx, qword [rsp + 0x70]
mov edx, eax
mov eax, edi
mov word [rcx + rdx*2], r15w
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140002f6c
int3
Function at 0x14004e1dc
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
je 0x14004e227
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004e238
lea rdx, str.DeleteFileTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004e238
mov rdx, qword [rbx]
mov rcx, rdi
call qword [case.0x14007cb16.0]
jmp 0x14004e23a
cmp dword [rcx + 8], 0
je 0x14004e238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14004e23a
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14004e480
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [rsp + 0x34]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x14004e4ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14004e4b6
mov rax, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 0x18]
call fcn.140002c84
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.14006fcb0
int3

Function at 0x14004e590
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14004e5f9
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004e60d
lea rdx, str.MoveFileTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004e60d
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x20], 2
mov rdx, rdi
call qword [case.0x14007cb16.0]
jmp 0x14004e60f
cmp dword [rcx + 8], 0
je 0x14004e60d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x14004e60f
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14004e870
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test r8d, r8d
jne 0x14004e882
xor eax, eax
jmp 0x14004e89f
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x50]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004e8a5
mov eax, dword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
lea rcx, [rbx + 0x18]
call fcn.140002c84
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.14006fcb0
int3

Function at 0x14004e8c4
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x14004e8e2
mov rdx, rcx
mov rcx, rax
call fcn.14004e1dc
jmp 0x14004e8e8
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14004e8f2
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.14006fcb0
int3
Function at 0x14004e904
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
mov rax, r8
mov rbx, rcx
test r8, r8
je 0x14004e925
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call fcn.14004e590
jmp 0x14004e92b
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14004e935
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.14006fcb0
int3

Function at 0x14004ea7c
Capabilities:
Write file on windows

Disassembly:
test r8d, r8d
je 0x14004eaba
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rdi, rcx
mov ebx, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004eabb
cmp dword [rsp + 0x50], ebx
jne 0x14004ead8
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rcx, [rdi + 0x18]
call fcn.140002c84
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.14006fcb0
int3
lea rcx, [rdi + 0x18]
call fcn.140002c84
or edx, 0xffffffff
mov r8, rax
lea ecx, [rdx + 0xe]
call fcn.14006f804
int3

Function at 0x14004f68c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax - 0x18], 0
mov rbp, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1401d0a9c
test eax, eax
jne 0x14004f6f0
mov eax, dword [rsp + 0x30]
lea r8, str._s_s_X.tmp
mov dword [rsp + 0x28], eax
mov r9, rsi
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.1400315fc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004f702
jmp 0x14004f6b0
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14004f900
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r8d, 1
mov rcx, rbx
and eax, 1
mov rax, qword [rbx]
mov rax, qword [rax + 0x1c0]
je 0x14004f942
xor edx, edx
call qword [case.0x14007cb16.0]
test eax, eax
je 0x14004f93e
mov eax, 1
jmp 0x14004f955
xor eax, eax
jmp 0x14004f955
mov rdx, qword [rbx + 0x48]
call qword [case.0x14007cb16.0]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x1400540d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.14000e48c
nop
cmp rbx, 0xffffffff80000000
jne 0x140054158
call fcn.14002a2fc
cmp eax, 1
jne 0x140054158
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.14001bf5c
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140003c9c
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140054151
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14007cb16.0]
mov rbx, 0xffffffff80000001
mov r9, rdi
mov r8, rsi
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140054194
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14007cb16.0]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400541a8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
mov esi, r8d
mov rbx, rcx
lea rcx, [rsp + 0x50]
call fcn.14000e48c
nop
cmp rbx, 0xffffffff80000000
jne 0x140054230
call fcn.14002a2fc
cmp eax, 1
jne 0x140054230
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.14001bf5c
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140003c9c
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140054229
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14007cb16.0]
mov rbx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140054274
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14007cb16.0]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140054c2c
Capabilities:
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ebp, 1
mov r12, r8
mov rdi, rdx
mov r15, rcx
mov r14d, ebp
cmp dword [rdx + 0x10], ebp
jle 0x140054cc0
lea ebx, [rbp + 7]
lea esi, [rbp + 0xf]
test r12, r12
je 0x140054c85
mov rax, qword [r15 + 0x10]
cmp qword [rax + rsi + 8], r12
je 0x140054c85
mov rax, qword [rdi + 0x18]
cmp qword [rbx + rax], 0
je 0x140054cac
xor r14d, r14d
jmp 0x140054cac
mov rax, qword [rdi + 0x18]
mov rcx, qword [rbx + rax]
test rcx, rcx
je 0x140054ca3
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14007cb16.0]
mov rax, qword [rdi + 0x18]
and qword [rbx + rax], 0
inc ebp
add rsi, 0x10
add rbx, 8
cmp ebp, dword [rdi + 0x10]
jl 0x140054c65
test r14d, r14d
je 0x140054d0c
lea rcx, [r15 + 0x28]
mov rsi, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [r15 + 0x18]
mov rdx, rdi
call fcn.140054fe0
lea rcx, [r15 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x14007cb16.0]
mov ecx, dword [r15]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret