joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486320
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
call fcn.0040c300
mov rcx, qword [rbx + 8]
mov rdx, rax
call sub.advapi32.dll_RegDeleteValueW
mov rcx, rbx
mov edx, eax
call fcn.00486050
add rsp, 0x20
pop rbx
ret

Function at 0x486600
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x58], rcx
mov dword [rbp + 0x50], r9d
mov qword [rbp + 0x98], rdx
mov qword [rbp + 0xa0], r8
mov rcx, qword [rbp + 0x98]
call fcn.0040ab90
mov rcx, qword [rbp + 0xa0]
call fcn.0040ab90
nop
xor rax, rax
mov byte [rbp + 0x57], al
xor rbx, rbx
mov rax, qword [0x005320b0]
cmp byte [rax], 0
je 0x486677
call fcn.00410c80
cmp byte [rax + 0x1b1], 0
je 0x486663
mov ebx, pe_nt_image_headers64
jmp 0x486677
call fcn.00410c80
cmp byte [rax + 0x1b0], 0
je 0x486677
mov ebx, 0x200
nop
mov rcx, qword [rbp + 0x98]
call fcn.0040c300
mov rcx, qword [rbp + 0x58]
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
or ebx, 0x20006
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x6c]
mov qword [rsp + 0x40], rax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
mov ecx, ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x486762
cmp qword [rbp + 0xa0], 0
jne 0x486713
mov rcx, qword [rbp + 0x60]
xor rdx, rdx
xor r8, r8
mov r9d, dword [rbp + 0x50]
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov eax, dword [rbp + 0xb8]
mov dword [rsp + 0x28], eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete al
mov byte [rbp + 0x57], al
jmp 0x486752
mov rcx, qword [rbp + 0xa0]
call fcn.0040c300
mov rcx, qword [rbp + 0x60]
mov rdx, rax
xor r8, r8
mov r9d, dword [rbp + 0x50]
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov eax, dword [rbp + 0xb8]
mov dword [rsp + 0x28], eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete al
mov byte [rbp + 0x57], al
mov ecx, ebx
call sub.kernel32.dll_SetLastError
mov rcx, qword [rbp + 0x60]
call sub.advapi32.dll_RegCloseKey_1
nop
lea rcx, [rbp + 0x98]
mov edx, 2
call fcn.0040aae0
movzx rax, byte [rbp + 0x57]
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x4867c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x34], r9d
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.0040ab90
mov rcx, qword [rbp + 0x90]
call fcn.0040ab90
nop
xor rax, rax
mov byte [rbp + 0x33], al
mov rax, qword [rbp + 0xa0]
mov qword [rax], 0
mov rax, qword [rbp + 0xa8]
mov dword [rax], 0
xor rbx, rbx
mov rax, qword [0x005320b0]
cmp byte [rax], 0
je 0x486853
call fcn.00410c80
cmp byte [rax + 0x1b1], 0
je 0x48683f
mov ebx, pe_nt_image_headers64
jmp 0x486853
call fcn.00410c80
cmp byte [rax + 0x1b0], 0
je 0x486853
mov ebx, 0x200
nop
mov rcx, qword [rbp + 0x88]
call fcn.0040c300
mov rcx, qword [rbp + 0x38]
mov rdx, rax
xor r8, r8
mov r9d, ebx
or r9d, 0x20019
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x486941
cmp qword [rbp + 0x90], 0
jne 0x486899
xor rsi, rsi
jmp 0x4868a8
mov rcx, qword [rbp + 0x90]
call fcn.0040c300
mov rsi, rax
mov rcx, qword [rbp + 0x50]
mov rdx, rsi
xor r8, r8
lea r9, [rbp + 0x5c]
mov qword [rsp + 0x20], 0
lea rax, [rbp + 0x4c]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x486938
mov ecx, dword [rbp + 0x4c]
call fcn.00405990
mov rbx, rax
mov rcx, qword [rbp + 0x50]
mov rdx, rsi
xor r8, r8
lea r9, [rbp + 0x5c]
mov qword [rsp + 0x20], rbx
lea rax, [rbp + 0x4c]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x486930
mov eax, dword [rbp + 0x34]
cmp eax, dword [rbp + 0x5c]
jne 0x486926
mov rax, qword [rbp + 0xa0]
mov qword [rax], rbx
mov rax, qword [rbp + 0xa8]
mov ecx, dword [rbp + 0x4c]
mov dword [rax], ecx
mov al, 1
mov byte [rbp + 0x33], al
jmp 0x486938
mov rcx, rbx
call fcn.004059c0
jmp 0x486938
mov rcx, rbx
call fcn.004059c0
mov rcx, qword [rbp + 0x50]
call sub.advapi32.dll_RegCloseKey_1
nop
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040aae0
movzx rax, byte [rbp + 0x33]
lea rsp, [rbp + 0x60]
pop rbx
pop rsi
pop rbp
ret

Function at 0x486cd0
Capabilities:
Delete registry value

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
xor rax, rax
mov byte [rbp + 0x3f], al
xor r13, r13
mov rax, qword [0x005320b0]
cmp byte [rax], 0
je 0x486d27
call fcn.00410c80
cmp byte [rax + 0x1b1], 0
je 0x486d12
mov r13d, pe_nt_image_headers64
jmp 0x486d27
call fcn.00410c80
cmp byte [rax + 0x1b0], 0
je 0x486d27
mov r13d, 0x200
nop
mov rcx, rsi
call fcn.0040c300
mov rcx, rbx
mov rdx, rax
xor r8, r8
mov r9d, r13d
or r9d, 0x20006
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
mov ecx, ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x486d83
mov rcx, rdi
call fcn.0040c300
mov rcx, qword [rbp + 0x48]
mov rdx, rax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete al
mov byte [rbp + 0x3f], al
mov rcx, qword [rbp + 0x48]
call sub.advapi32.dll_RegCloseKey_1
movzx rax, byte [rbp + 0x3f]
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x486da0
Capabilities:
Delete registry key

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
mov rax, qword [0x005320b0]
cmp byte [rax], 0
jne 0x486ddd
mov rcx, qword [rbp + 0x58]
call fcn.0040c300
mov rcx, qword [rbp + 0x50]
mov rdx, rax
call sub.advapi32.dll_RegDeleteKeyW
mov dword [rbp + 0x3c], eax
jmp 0x486e5f
nop
mov dword [rbp + 0x38], 0
mov rax, qword [0x005320b0]
cmp byte [rax], 0
je 0x486e1d
call fcn.00410c80
cmp byte [rax + 0x1b1], 0
je 0x486e08
mov dword [rbp + 0x38], pe_nt_image_headers64
jmp 0x486e1d
call fcn.00410c80
cmp byte [rax + 0x1b0], 0
je 0x486e1d
mov dword [rbp + 0x38], 0x200
nop
mov rcx, qword [rbp + 0x58]
call fcn.0040c300
mov rcx, qword [rbp + 0x50]
mov rdx, rax
mov r8d, dword [rbp + 0x38]
xor r9, r9
call sub.advapi32.dll_RegDeleteKeyExW
mov dword [rbp + 0x3c], eax
jmp 0x486e5f
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x486fd0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
sub rsp, 0xb0
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rdx
mov byte [rbp + 0xd0], r8b
nop
mov byte [rbp + 0x9f], 0
lea rcx, [0x0048737c]
mov rdx, qword [rbp + 0xc8]
call fcn.0040cc00
test eax, eax
je 0x487283
cmp byte [rbp + 0xd0], 0
je 0x487269
nop
mov dword [rbp + 0x7c], 0
mov rax, qword [0x005320b0]
cmp byte [rax], 0
je 0x487082
call fcn.00410c80
cmp byte [rax + 0x1b1], 0
je 0x48706d
mov dword [rbp + 0x7c], pe_nt_image_headers64
jmp 0x487082
call fcn.00410c80
cmp byte [rax + 0x1b0], 0
je 0x487082
mov dword [rbp + 0x7c], 0x200
nop
mov rcx, qword [rbp + 0xc8]
call fcn.0040c300
mov rcx, qword [rbp + 0xc0]
mov rdx, rax
xor r8, r8
mov r9d, dword [rbp + 0x7c]
or r9d, 0x2000f
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
mov dword [rbp + 0x98], eax
nop
cmp dword [rbp + 0x98], 0
jne 0x487243
mov dword [rbp + 0x90], 0
mov rcx, qword [rbp + 0xa0]
xor rdx, rdx
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x487243
mov eax, dword [rbp + 0x90]
sub eax, 1
mov dword [rbp + 0x8c], eax
cmp dword [rbp + 0x8c], 0
jl 0x487242
mov eax, dword [0x00524670]
mov dword [rbp + 0x94], eax
lea rcx, [rbp + 0xa8]
mov edx, dword [rbp + 0x94]
call fcn.0040c570
lea rcx, [rbp + 0xa8]
call fcn.0040b340
mov rcx, qword [rbp + 0xa0]
mov edx, dword [rbp + 0x8c]
mov r8, rax
lea r9, [rbp + 0x94]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x48722e
lea rcx, [rbp + 0xa8]
mov edx, dword [rbp + 0x94]
call fcn.0040c570
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0xc8]
call fcn.00431c90
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0xa8]
call fcn.0040c720
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x80]
movzx r8, byte [rbp + 0xd0]
call fcn.00486fd0
test al, al
jne 0x48722e
xor rcx, rcx
mov rdx, qword [rbp + 0x68]
call fcn.004872c0
jmp 0x487283
sub dword [rbp + 0x8c], 1
cmp dword [rbp + 0x8c], 0xffffffff
jne 0x48715a
nop
nop
lea rcx, [rbp + 0xa8]
xor rdx, rdx
call fcn.0040c570
mov rcx, qword [rbp + 0xa0]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x487269
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xc8]
call fcn.00486e80
mov byte [rbp + 0x9f], al
nop
lea rcx, [rbp + 0x60]
call fcn.0040aa00
lea rcx, [rbp + 0x80]
call fcn.0040aa00
lea rcx, [rbp + 0xa8]
call fcn.0040aa00
movzx rax, byte [rbp + 0x9f]
lea rsp, [rbp + 0xb0]
pop rbp
ret
Function at 0x487dd0
Capabilities:
Check os version

Disassembly:
push rbp
sub rsp, 0x150
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov byte [rbp + 0x14f], 7
nop
mov dword [rbp + 0x30], 0x11c
lea rcx, [rbp + 0x30]
call sub.kernel32.dll_GetVersionExW
cmp dword [rbp + 0x40], 2
jne 0x487e9c
mov byte [rbp + 0x14f], 5
cmp dword [rbp + 0x34], 6
jb 0x487e6e
mov byte [rbp + 0x14f], 0xa
cmp byte [rbp + 0x14a], 1
jne 0x487e46
cmp dword [rbp + 0x38], 2
jb 0x487e30
mov byte [rbp + 0x14f], 0xe
jmp 0x487ee2
cmp dword [rbp + 0x38], 1
jb 0x487ee2
mov byte [rbp + 0x14f], 0xd
jmp 0x487ee2
mov byte [rbp + 0x14f], 0xb
cmp dword [rbp + 0x38], 2
jb 0x487e5f
mov byte [rbp + 0x14f], 0xf
jmp 0x487ee2
cmp dword [rbp + 0x38], 1
jb 0x487ee2
mov byte [rbp + 0x14f], 0xc
jmp 0x487ee2
cmp dword [rbp + 0x34], 5
jb 0x487ee2
mov byte [rbp + 0x14f], 6
cmp dword [rbp + 0x38], 1
jb 0x487ee2
cmp byte [rbp + 0x14a], 1
jne 0x487e93
mov byte [rbp + 0x14f], 7
jmp 0x487ee2
mov byte [rbp + 0x14f], 9
jmp 0x487ee2
cmp dword [rbp + 0x40], 1
jne 0x487ed1
mov byte [rbp + 0x14f], 1
cmp dword [rbp + 0x34], 4
jne 0x487ebc
cmp dword [rbp + 0x38], 0xa
jne 0x487ebc
mov byte [rbp + 0x14f], 2
cmp dword [rbp + 0x34], 4
jne 0x487ee2
cmp dword [rbp + 0x38], 0x5a
jne 0x487ee2
mov byte [rbp + 0x14f], 3
jmp 0x487ee2
mov byte [rbp + 0x14f], 1
jmp 0x487ee2
movzx rax, byte [rbp + 0x14f]
lea rsp, [rbp + 0x150]
pop rbp
ret
Function at 0x488db0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x78], rdx
mov rcx, qword [rbp + 0x78]
call fcn.0040ab90
nop
mov rcx, qword [rbp + 0x38]
call fcn.0040aa00
lea rcx, [0x00488fc4]
mov rdx, qword [rbp + 0x78]
call fcn.0040cc00
test eax, eax
jne 0x488ec0
lea rcx, [rbp + 0x48]
mov edx, 1
call fcn.0040c570
mov rcx, qword [rbp + 0x78]
call fcn.0040c300
mov rbx, rax
mov rcx, qword [rbp + 0x48]
call fcn.0040c300
xor rcx, rcx
mov rdx, rbx
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_SearchPathW
mov ebx, eax
add ebx, 1
lea rcx, [rbp + 0x48]
mov edx, ebx
call fcn.0040c570
mov rcx, qword [rbp + 0x78]
call fcn.0040c300
mov rsi, rax
mov rcx, qword [rbp + 0x48]
call fcn.0040c300
xor rcx, rcx
mov rdx, rsi
xor r8, r8
mov r9d, ebx
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_SearchPathW
test eax, eax
je 0x488eae
mov rcx, qword [rbp + 0x48]
call fcn.0040c300
mov rcx, rax
call fcn.0040b260
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.0040c570
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x48]
call fcn.0040b050
jmp 0x488f61
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x78]
call fcn.0040b050
jmp 0x488f61
lea rcx, [rbp + 0x48]
mov edx, 1
call fcn.0040c570
mov rcx, qword [rbp + 0x78]
call fcn.0040c300
mov rbx, rax
mov rcx, qword [rbp + 0x48]
call fcn.0040c300
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
add ebx, 1
lea rcx, [rbp + 0x48]
mov edx, ebx
call fcn.0040c570
mov rcx, qword [rbp + 0x78]
call fcn.0040c300
mov rsi, rax
mov rcx, qword [rbp + 0x48]
call fcn.0040c300
mov rcx, rsi
mov rdx, rax
mov r8d, ebx
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x488f54
mov rcx, qword [rbp + 0x48]
call fcn.0040c300
mov rcx, rax
call fcn.0040b260
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.0040c570
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x48]
call fcn.0040b050
jmp 0x488f61
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x78]
call fcn.0040b050
nop
lea rcx, [rbp + 0x48]
call fcn.0040aa00
lea rcx, [rbp + 0x78]
call fcn.0040aa00
mov rax, qword [rbp + 0x38]
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x4897e0
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x250
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x260], rcx
nop
mov rcx, qword [rbp + 0x260]
call fcn.0040aa00
nop
mov ecx, 0xff
lea rdx, [rbp + 0x50]
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x4898da
mov rcx, qword [rbp + 0x260]
lea rdx, [rbp + 0x50]
call fcn.0040c380
lea rcx, [rbp + 0x30]
mov rax, qword [rbp + 0x260]
mov rdx, qword [rax]
call fcn.0048b120
mov rcx, qword [rbp + 0x260]
mov rdx, qword [rbp + 0x30]
call fcn.0040b050
lea rcx, [rbp + 0x28]
mov rax, qword [rbp + 0x260]
mov rdx, qword [rax]
call fcn.00489650
mov rcx, qword [rbp + 0x260]
mov rdx, qword [rbp + 0x28]
call fcn.0040b050
mov rax, qword [rbp + 0x260]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x44], 0
cmp qword [rbp + 0x48], 0
je 0x4898a7
mov rax, qword [rbp + 0x48]
mov eax, dword [rax - 4]
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 0x260]
mov rax, qword [rax]
movsxd rcx, dword [rbp + 0x44]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x4898da
mov rcx, qword [rbp + 0x260]
lea rdx, [0x00489944]
call fcn.0040c650
jmp 0x4898da
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040aae0
mov rax, qword [rbp + 0x260]
lea rsp, [rbp + 0x250]
pop rbp
ret
Function at 0x489950
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xa0], rcx
nop
nop
call fcn.00487f10
cmp al, 0xa
jb 0x489a65
lea rcx, [rbp + 0x88]
mov edx, 0x104
call fcn.0040c570
nop
mov rcx, qword [rbp + 0x88]
call fcn.0040c300
xor rcx, rcx
mov edx, 0x1a
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], rax
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x489a55
mov rcx, qword [rbp + 0x88]
call fcn.0040c300
mov rcx, qword [rbp + 0xa0]
mov rdx, rax
call fcn.00428d00
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov qword [rbp + 0x80], rax
mov dword [rbp + 0x7c], 0
cmp qword [rbp + 0x80], 0
je 0x489a1b
mov rax, qword [rbp + 0x80]
mov eax, dword [rax - 4]
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 0
jle 0x489a44
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax]
call fcn.00431c90
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x40]
call fcn.0040b050
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.00489b70
jmp 0x489b3a
nop
lea rcx, [rbp + 0x88]
xor rdx, rdx
call fcn.0040c570
mov rax, qword [0x005323d8]
mov rcx, qword [rax]
lea rdx, [0x00489bfc]
lea r8, [0x00489c8c]
mov r9, qword [rbp + 0xa0]
call fcn.00486b00
test al, al
je 0x489b39
lea rcx, [rbp + 0x38]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax]
call fcn.00489650
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x38]
call fcn.0040b050
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x6c], 0
cmp qword [rbp + 0x70], 0
je 0x489ada
mov rax, qword [rbp + 0x70]
mov eax, dword [rax - 4]
mov dword [rbp + 0x6c], eax
cmp dword [rbp + 0x6c], 0
jle 0x489b39
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x5c], 0
cmp qword [rbp + 0x60], 0
je 0x489b06
mov rax, qword [rbp + 0x60]
mov eax, dword [rax - 4]
mov dword [rbp + 0x5c], eax
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
movsxd rcx, dword [rbp + 0x5c]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x489b39
mov rcx, qword [rbp + 0xa0]
lea rdx, [0x00489ca8]
call fcn.0040c650
jmp 0x489b39
nop
lea rcx, [rbp + 0x38]
mov edx, 2
call fcn.0040aae0
lea rcx, [rbp + 0x88]
call fcn.0040aa00
mov rax, qword [rbp + 0xa0]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x48a4f0
Capabilities:
Create directory

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov byte [rbp + 0x26], dl
mov byte [rbp + 0x27], r8b
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
nop
mov al, 1
mov byte [rbp + 0x25], al
mov qword [rbp + 0x58], 0
movzx rax, byte [rbp + 0x26]
test al, al
je 0x48a553
call fcn.00488c50
mov qword [rbp + 0x58], rax
xor rax, rax
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x48a566
mov rax, qword [rbp + 0x28]
mov eax, dword [rax - 4]
test eax, eax
jne 0x48a575
xor rax, rax
mov byte [rbp + 0x25], al
jmp 0x48a6cb
movzx rax, byte [rbp + 0x27]
test al, al
je 0x48a6ad
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x28]
call fcn.0040b0d0
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x50]
call fcn.00431cf0
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x48]
call fcn.0040b0d0
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.00428350
xor rax, rax
cmp qword [rbp + 0x60], 0
je 0x48a5c7
mov rax, qword [rbp + 0x60]
mov eax, dword [rax - 4]
cmp eax, 2
jne 0x48a5fe
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x60]
mov r8d, 2
mov r9d, 1
call fcn.0040c930
mov rcx, qword [rbp + 0x38]
lea rdx, [0x0048a778]
call fcn.0040c920
test eax, eax
sete al
jmp 0x48a601
xor rax, rax
test al, al
je 0x48a609
mov al, 1
jmp 0x48a614
mov rcx, qword [rbp + 0x60]
mov dl, 1
call fcn.00427a50
test al, al
je 0x48a61c
mov al, 1
jmp 0x48a62e
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.0040c920
test eax, eax
sete al
test al, al
jne 0x48a6cb
cmp qword [rbp + 0x68], 0
jne 0x48a65c
mov rcx, qword [rbp + 0x60]
call fcn.0040c300
mov rcx, rax
mov rdx, qword [rbp + 0x58]
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
mov byte [rbp + 0x25], al
jmp 0x48a6ca
mov rcx, qword [rbp + 0x68]
call fcn.0040c300
lea rcx, [rbp + 0x30]
mov rdx, rax
call fcn.0040c380
mov rcx, qword [rbp + 0x30]
movzx rdx, byte [rbp + 0x26]
movzx r8, byte [rbp + 0x27]
call fcn.0048a4f0
test al, al
je 0x48a6a1
mov rcx, qword [rbp + 0x60]
call fcn.0040c300
mov rcx, rax
mov rdx, qword [rbp + 0x58]
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x48a6a6
xor rax, rax
jmp 0x48a6a8
mov al, 1
mov byte [rbp + 0x25], al
jmp 0x48a6ca
mov rcx, qword [rbp + 0x28]
call fcn.0040c300
mov rcx, rax
lea rdx, [rbp + 0x58]
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
mov byte [rbp + 0x25], al
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040aae0
lea rcx, [rbp + 0x48]
mov edx, 2
call fcn.0040aae0
lea rcx, [rbp + 0x60]
mov edx, 2
call fcn.0040aae0
movzx rax, byte [rbp + 0x25]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x48a780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call fcn.0040c300
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x48a79e
test eax, 0x10
jne 0x48a7a3
xor rax, rax
jmp 0x48a7a5
mov al, 1
add rsp, 0x28
ret
Function at 0x48b000
Capabilities:
Copy file

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov r13d, r9d
xor r14, r14
mov rcx, rbx
call fcn.0048b0f0
test al, al
je 0x48b07c
mov rcx, rsi
call fcn.0048b0f0
test al, al
je 0x48b043
test r13b, r13b
je 0x48b07c
mov rcx, rsi
call fcn.0048b090
test al, al
je 0x48b07c
mov rcx, rbx
call fcn.0040c300
mov rbx, rax
mov rcx, rsi
call fcn.0040c300
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_CopyFileW
test eax, eax
setne r14b
test r14b, r14b
je 0x48b07c
test dil, dil
je 0x48b07c
mov rcx, rsi
call fcn.0048af00
mov eax, r14d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret

Function at 0x48b090
Capabilities:
Set file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
xor rsi, rsi
mov rcx, rbx
call fcn.0048b0f0
test al, al
je 0x48b0e1
mov rcx, rbx
call fcn.004280a0
mov esi, eax
test sil, sil
jne 0x48b0e1
mov rcx, rbx
call fcn.0048af00
mov rcx, rbx
call fcn.0040c300
mov rcx, rax
mov edx, 0x80
call sub.kernel32.dll_SetFileAttributesW
mov rcx, rbx
call fcn.004280a0
mov esi, eax
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x48b0f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call fcn.0040c300
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x48b10e
test eax, 0x10
je 0x48b113
xor rax, rax
jmp 0x48b115
mov al, 1
add rsp, 0x28
ret

Function at 0x48ca30
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x40], rcx
mov rax, qword [rbp + 0x40]
mov byte [rax + 0x10], 0
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 8]
call fcn.0040c300
mov rcx, rax
mov rdx, qword [rbp + 0x40]
add rdx, 0x20
call sub.version.dll_GetFileVersionInfoSizeW
mov rcx, qword [rbp + 0x40]
mov dword [rcx + 0x14], eax
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0x14], 0
jbe 0x48caec
nop
mov rax, qword [rbp + 0x40]
mov ecx, dword [rax + 0x14]
call fcn.00405990
mov rcx, qword [rbp + 0x40]
mov qword [rcx + 0x18], rax
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x18]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x14]
xor r8, r8
call fcn.00406de0
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 8]
call fcn.0040c300
mov rcx, rax
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x20]
mov rax, qword [rbp + 0x40]
mov r8d, dword [rax + 0x14]
mov rax, qword [rbp + 0x40]
mov r9, qword [rax + 0x18]
call sub.version.dll_GetFileVersionInfoW
mov rcx, qword [rbp + 0x40]
test eax, eax
setne al
mov byte [rcx + 0x10], al
jmp 0x48caec
lea rsp, [rbp + 0x30]
pop rbp
ret
Function at 0x492190
Capabilities:
Set file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov word [rbp + 0x50], dx
mov word [rbp + 0x52], r8w
mov word [rbp + 0x4e], r9w
mov qword [rbp + 0x58], 0
nop
call fcn.00495950
mov rbx, rax
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x40]
call fcn.0040c350
mov rcx, rbx
mov rdx, qword [rbp + 0x58]
call fcn.004910a0
test al, al
je 0x4921ea
mov eax, 1
mov dword [rbp + 0x54], eax
jmp 0x4922a5
mov rcx, qword [rbp + 0x40]
mov edx, 0xc0000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x8000080
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileA
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x49223b
call sub.kernel32.dll_GetLastError_2
mov rcx, qword [rbp + 0xc0]
mov dword [rcx], eax
xor rax, rax
mov dword [rbp + 0x54], eax
jmp 0x4922a4
movzx rcx, word [rbp + 0x50]
movzx rdx, word [rbp + 0x52]
lea r8, [rbp + 0x78]
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x49227e
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x68], rax
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x70]
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x49227e
mov rcx, rbx
lea rdx, [rbp + 0x70]
xor r8, r8
lea r9, [rbp + 0x70]
call sub.kernel32.dll_SetFileTime
mov rcx, rbx
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0x40]
movzx rdx, word [rbp + 0x4e]
and dx, 0x27
movzx edx, dx
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
mov dword [rbp + 0x54], eax
nop
lea rcx, [rbp + 0x58]
call fcn.0040aa00
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret