joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012b9f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x140257270]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x2a9
call fcn.14007e2d0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14008e970
cmp byte [rdi + 0x17], 0
jns 0x14012ba74
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.14007d0f0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, edi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x14012c0f0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1400cf750
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14012c18f
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.1400ca328
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.14009f4c0
lea rsi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.1400afca0
mov rcx, r14
mov rdx, rsi
call fcn.1400b4d80
mov rcx, rsi
call fcn.14007cab0
mov rcx, rbx
call fcn.14007cab0
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14012cc20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402910c8]
cmp ecx, 0xffffffff
je 0x14012cc45
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14012cc40
Function at 0x14013b400
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x14013b530
cmp qword [rsi], 0
jne 0x14013b530
cmp dword [rsi + 0x14], 0
jne 0x14013b530
cmp qword [rsi + 8], 0
jne 0x14013b530
xor eax, eax
mov rbx, qword [rdi]
cmp rax, rbx
je 0x14013b471
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14013b4c2
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14013b469
mov qword [rsi], rbx
call fcn.140071760
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rdi + 8]
cmp qword [rsi + 8], rbp
je 0x14013b4ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14013b4ea
lea rax, [rbp + 1]
cmp rax, 2
jb 0x14013b4a3
mov qword [rsi + 8], rbp
call fcn.140071760
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140071760
mov r14, qword [rsi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x14013b514
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x14013b457
call fcn.140071760
mov r14, qword [rsi + 8]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x14013b522
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi + 8], 0
jmp 0x14013b490
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x14013b4d6
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x14013b4ff
mov rcx, rsi
call fcn.14013a5c0
mov rax, qword [rsi]
jmp 0x14013b43b

Function at 0x140140546
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14022c8a0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x14014059f
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ccfe0
nop
add rsp, 0x40
pop rsi
ret
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x1b
call fcn.140189280
mov rcx, rsi
call fcn.1401892a0
lea rdx, [0x14026cfd8]
mov r8d, 0xc
mov rcx, rax
call fcn.1400a7acb
mov rcx, rsi
call fcn.1401892b0
jmp 0x14014058b
Function at 0x140140fcf
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14013b0ed
test rax, rax
jne 0x14014100e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x14014102a
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x140141080
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfc
mov r9d, 2
call fcn.14014efd0
lea rcx, [rsp + 0x40]
lea rdx, [0x14025f3fe]
mov r8d, 0xc
call fcn.1400a7acb
mov rcx, rsi
call fcn.1401412f0
xor esi, esi
jmp 0x14014100e
Function at 0x140141d90
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov esi, ecx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movsxd rbx, edx
movsxd rax, ecx
sub rbx, rax
inc rbx
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rsp + 0x28], r14
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140141e1b
mov rax, 0xffffffffffffffff
xor edx, edx
div rbx
mov rcx, 0xfffffffffffffffe
sub rcx, rdx
mov rax, qword [rsp + 0x28]
cmp rax, rcx
ja 0x140141dc5
xor edx, edx
div rbx
add esi, edx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
int3

Function at 0x140141f67
Capabilities:
Check os version

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x168], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x140142043
and eax, 0xfeff
cmp eax, 6
je 0x140142043
mov eax, dword [0x14029bed8]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14014200a
lea rcx, [0x14029bed8]
call fcn.1400c9d58
cmp dword [0x14029bed8], 0xffffffff
jne 0x14014200a
lea rcx, [0x14025755e]
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.1401420ab
mov qword [0x14029bed0], rax
lea rcx, [0x14029bed8]
call fcn.1400c9cf8
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x14029bed0]
mov esi, eax
test eax, eax
je 0x140142050
test esi, esi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov bl, 1
jmp 0x140142026
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x140142021
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x21
mov r9d, 2
call fcn.14014efd0
lea rcx, [rsp + 0x38]
lea rdx, str.InitializeCriticalSectionEx
mov r8d, 0x1b
call fcn.1400a7acb
mov rcx, rdi
call fcn.1401412f0
jmp 0x140142021
Function at 0x140143ced
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov r14, r8
mov rdi, rdx
mov r12, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp byte [r8 + 0x17], 0
js 0x140143f0a
mov word [r14], 0
mov byte [r14 + 0x17], 0
test r12, r12
je 0x140143eb9
lea r8, [rsp + 0x50]
mov qword [r8], 0
lea r9, [rsp + 0x260]
mov dword [r9], 0
lea rdx, str.VarFileInfoTranslation
mov rcx, r12
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140143eb9
lea r13, [rsp + 0x50]
mov rax, qword [r13]
movzx ebx, word [rax]
movzx ebp, word [rax + 2]
mov word [rsp + 0x260], bx
mov word [rsp + 0x262], bp
mov rsi, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call rsi
mov word [rsp + 0x264], ax
mov word [rsp + 0x266], bp
mov word [rsp + 0x268], bx
mov bp, 0x4e4
mov word [rsp + 0x26a], bp
call rsi
mov word [rsp + 0x26c], ax
mov word [rsp + 0x26e], bp
xor r15d, r15d
lea rsi, [rsp + 0x48]
lea rbp, [rsp + 0x44]
mov r8d, 0x208
mov rcx, r13
mov dl, 0xaa
call fcn.1400cf750
cmp byte [rdi + 0x17], 0
mov rax, rdi
jns 0x140143df4
mov rax, qword [rdi]
movzx ecx, word [rsp + r15*2 + 0x262]
movzx edx, bx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov edx, 0x104
mov r8d, 0x104
mov rcx, r13
lea r9, str.StringFileInfo_04hx_04hx_ls
call fcn.140143f50
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
mov rcx, r12
mov rdx, r13
mov r8, rsi
mov r9, rbp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140143e57
mov rbx, qword [rsp + 0x48]
test rbx, rbx
jne 0x140143e6f
cmp r15, 5
ja 0x140143eb9
movzx ebx, word [rsp + r15*2 + 0x264]
add r15, 2
jmp 0x140143dd8
mov rcx, rbx
call fcn.1400ca328
mov rsi, rax
movzx r9d, byte [r14 + 0x17]
test r9b, r9b
js 0x140143f1f
cmp rsi, 0xa
jbe 0x140143ede
mov edx, 0xa
mov r8, rsi
sub r8, rdx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], 0
mov rcx, r14
call fcn.1400091e0
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400ccfe0
nop
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdi, r14
test rsi, rsi
je 0x140143ef7
mov r8, rsi
add r8, rsi
mov rcx, rdi
mov rdx, rbx
call fcn.1400cf0a0
mov word [rdi + rsi*2], 0
cmp byte [r14 + 0x17], 0
js 0x140143f3e
mov byte [r14 + 0x17], sil
jmp 0x140143eb9
mov rax, qword [r14]
mov word [rax], 0
mov qword [r14 + 8], 0
jmp 0x140143d31
movabs rdx, 0x7fffffffffffffff
and rdx, qword [r14 + 0x10]
dec rdx
cmp rdx, rsi
jae 0x140143f47
mov r9, qword [r14 + 8]
jmp 0x140143e93
mov qword [r14 + 8], rsi
jmp 0x140143eb9
mov rdi, qword [r14]
jmp 0x140143ee1
Function at 0x140143fd3
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.1400c9cbc
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14017c570]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.1400cb080
mov qword [rbx], rax
test rax, rax
je 0x14014402a
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140145a48
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140145a7f
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140145a7f
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x140145a7f
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x140145a7e

Function at 0x14014689e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
test r8, r8
je 0x14014699e
mov r11, qword [rcx + 8]
movsxd rcx, dword [r11 + 0x3c]
cmp dword [r11 + rcx + 0x84], 0
je 0x14014699e
add rcx, r11
xor eax, eax
cmp word [rcx + 0x14], 0x78
jb 0x1401469c6
add rcx, 0x88
je 0x1401469c6
mov r10d, dword [rcx]
test r10, r10
je 0x14014699e
add r10, r11
je 0x14014699e
cmp rdx, 0xffff
jbe 0x1401469c0
mov eax, dword [r10 + 0x18]
mov ecx, dword [r10 + 0x20]
lea r9, [r11 + rcx]
test rcx, rcx
cmove r9, rcx
lea rcx, [rax*4]
test rcx, rcx
je 0x14014699e
lea rax, [r9 + rax*4]
mov r14b, byte [rdx]
inc rdx
mov rsi, r9
mov rdi, rax
sub rdi, rsi
mov rcx, rdi
sar rcx, 2
shr rdi, 0x3f
add rdi, rcx
and rdi, 0xfffffffffffffffe
mov ecx, dword [rsi + rdi*2]
lea rbx, [r11 + rcx]
test rcx, rcx
cmove rbx, rcx
test r14b, r14b
je 0x140146976
mov rcx, rdx
mov ebp, r14d
cmp bpl, byte [rbx]
jne 0x140146978
inc rbx
mov bpl, byte [rcx]
inc rcx
test bpl, bpl
jne 0x140146963
xor ebp, ebp
lea rdi, [rsi + rdi*2]
movzx ecx, bpl
movzx ebx, byte [rbx]
mov ebp, ecx
sub ebp, ebx
lea r15, [rdi + 4]
test ebp, ebp
cmovg rsi, r15
cmp ecx, ebx
cmovs rax, rdi
je 0x1401469a2
cmp rsi, rax
jne 0x140146932
xor eax, eax
jmp 0x1401469c6
mov eax, dword [r10 + 0x24]
add r11, rax
test rax, rax
cmove r11, rax
sub rdi, r9
sar rdi, 1
movzx edx, word [r11 + rdi]
add dx, word [r10 + 0x10]
mov word [r8], dx
mov al, 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140147fd0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rdi, [rcx + 8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rsi, qword [rsi]
test rsi, rsi
jne 0x140147ffb
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp sub.KERNEL32.dll_ReleaseSRWLockExclusive
lock inc dword [rsi]
mov rcx, rdi
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov rcx, rsi
call fcn.1401aa020
lock dec dword [rsi]
je 0x14014801a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.1401a9fc0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400089f0
Function at 0x14014fad0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov r14d, r8d
mov r15, rdx
mov rbx, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x60]
mov qword [rsi + 0x50], rdi
movaps xmm0, xmmword [0x140257270]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, [0x14025cc7f]
lea r8, str..._.._base_files_file_util_win.cc
lea rbp, [rsp + 0x40]
mov rcx, rbp
mov r9d, 0x41a
call fcn.14007e2d0
xor r12d, r12d
mov rcx, rsi
mov rdx, rbp
xor r8d, r8d
call fcn.14008e970
mov qword [rbp], rdi
cmp byte [rbx + 0x17], 0
jns 0x14014fb68
mov rbx, qword [rbx]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rsi, [rsp + 0x40]
mov qword [rsi], r12
mov rcx, rsi
mov rdx, rax
call fcn.1400bdb78
mov rcx, qword [rsi]
mov ebx, 0xffffffff
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14014fbea
lea rsi, [rsp + 0x3c]
mov dword [rsi], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rdx, r15
mov r8d, r14d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
cmp eax, 1
sbb ebx, ebx
or ebx, dword [rsi]
mov rcx, qword [rsp + 0x40]
inc rcx
cmp rcx, 2
jae 0x14014fc21
lea rcx, [rsp + 0x60]
call fcn.14007d0f0
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140071760
mov rsi, qword [rsp + 0x40]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x14014fc41
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax]
jmp 0x14014fbf3
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x14014fc37

Function at 0x140155590
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rdx, str.HasValue
lea r8, str..._.._base_win_registry.cc
lea rcx, [rsp + 0x38]
mov r9d, 0xf9
call fcn.14007e2d0
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140158ba0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x50], rax
movaps xmm0, xmmword [0x140257270]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, [0x14025cc88]
lea r8, str..._.._base_files_file_util_win.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r9d, 0x42a
call fcn.14007e2d0
xor r15d, r15d
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
call fcn.14008e970
cmp byte [rbx + 0x17], 0
jns 0x140158c32
mov rbx, qword [rbx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x140158c89
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rdi, 0xffffffffffffffff
je 0x140158d32
call fcn.140071760
mov r15, rdi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdi, [r15 + 1]
cmp rdi, 2
jb 0x140158d1d
lea rsi, [rsp + 0x40]
mov dword [rsi], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, r14
mov r8d, ebp
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsi]
xor edx, edx
cmp eax, 1
sbb edx, edx
cmp ecx, ebp
mov esi, 0xffffffff
cmove esi, ecx
or esi, edx
cmp rdi, 2
jb 0x140158cf1
call fcn.140071760
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x140158d24
mov rax, qword [rcx]
mov rdx, r15
call qword [rax]
lea rcx, [rsp + 0x60]
call fcn.14007d0f0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x140158cd2
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x140158ce9
xor r15d, r15d
jmp 0x140158c81
Function at 0x140163820
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov r15, r8
mov r13, rdx
mov rdi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx r14d, word [rcx + 0x28]
movzx r12d, word [rcx + 0x2a]
mov rsi, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call rsi
mov ebp, eax
movzx ebx, word [rdi + 0x2a]
movzx eax, word [rdi + 0x28]
mov dword [rsp + 0x40], eax
call rsi
mov word [rsp + 0x3e], ax
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.1400cf750
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r14d
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140143f50
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140163924
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140163924
mov r8d, dword [rsp + 0x44]
test r8d, r8d
je 0x140163924
dec r8d
mov rcx, r15
call fcn.1400bddd6
mov sil, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.1400cf750
movzx eax, bp
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140143f50
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1401639a3
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1401639a3
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x1401638f0
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.1400cf750
mov qword [rsp + 0x30], r13
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140143f50
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140163a27
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140163a27
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x1401638f0
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.1400cf750
movzx eax, word [rsp + 0x3e]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140143f50
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140163aac
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140163aac
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x1401638f0
xor esi, esi
jmp 0x1401638fe
Function at 0x140165010
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
lea rdi, [rsp + 0x40]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [rdi]
lea rcx, [rsp + 0x28]
call fcn.140098fa2
lea rdi, [rsi + 0x10]
cmp byte [rsi + 0x27], 0
jns 0x140165067
mov rcx, qword [rdi]
call fcn.1400c9cac
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdi], xmm0
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x140165084
mov rax, qword [rsi + 0x18]
test rax, rax
setne bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401656dc
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
lea rdi, [rsp + 0x40]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [rdi]
lea rcx, [rsp + 0x28]
call fcn.140098fa2
lea rdi, [rsi + 0x70]
cmp byte [rsi + 0x87], 0
jns 0x140165736
mov rcx, qword [rdi]
call fcn.1400c9cac
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdi], xmm0
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x140165753
mov rax, qword [rsi + 0x78]
test rax, rax
setne bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret

Function at 0x140165774
Capabilities:
Identify system language via api

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edx, ax
lea rcx, [rsp + 0x20]
call fcn.140098fa2
lea rdi, [rsi + 0x88]
cmp byte [rsi + 0x9f], 0
jns 0x1401657b8
mov rcx, qword [rdi]
call fcn.1400c9cac
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x1401657d8
mov rax, qword [rsi + 0x90]
test rax, rax
setne bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret