joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420b20
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_rwlock]
lea rcx, str.cond_locked_shmem_rwlock
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x421550
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init_init]
lea rcx, str.init
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x421570
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.eh_globals
xor r8d, r8d
mov edx, 0x10
jmp dbg.__shmem_grab

Function at 0x421c20
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___terminate_handler_sh]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x421c40
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___unexpected_handler_sh]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x422f00
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
test rax, rax
jle 0x422f31
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
mov dword [rbx + 0x48], 0xffffffff
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x423880
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x00487090], 0
jne 0x423947
mov byte [0x00487090], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x4239da
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov rsi, qword [sym.imp.msvcrt.dll___iob_func]
mov rdi, rax
call rsi
lea rcx, str.terminate_called_after_throwing_an_instance_of_
lea r9, [rax + 0x60]
mov r8d, 0x30
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x423937
call rsi
lea rdx, [rax + 0x60]
mov rcx, rbx
call sym.fputs
call rsi
lea rcx, [0x00489731]
lea r9, [rax + 0x60]
mov r8d, 2
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x42396d
call sym.__cxa_rethrow
call rsi
lea rdx, [rax + 0x60]
mov rcx, rdi
call sym.fputs
jmp 0x42390e
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_recursively_n
lea r9, [rax + 0x60]
mov r8d, 0x1d
mov edx, 1
call sym.fwrite
call sym.abort
mov rcx, rdi
call sym.free
jmp 0x423932
call sym.abort
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_without_an_active_exception_n
lea r9, [rax + 0x60]
mov r8d, 0x2d
mov edx, 1
call sym.fwrite
jmp 0x4239d5

Function at 0x451d00
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
mov rcx, rbp
call method.std::__basic_file_char_.fd__
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sym.read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x451d50
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x451d1a
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x180001000
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x10
movzx eax, byte [rdx]
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
movzx eax, byte [rdx + 2]
mov byte [rcx + 2], al
movzx eax, byte [rdx + 3]
mov byte [rcx + 3], al
movzx eax, byte [rdx + 4]
mov byte [rcx + 4], al
movzx eax, byte [rdx + 5]
mov byte [rcx + 5], al
movzx eax, byte [rdx + 6]
mov byte [rcx + 6], al
movzx eax, byte [rdx + 7]
mov byte [rcx + 7], al
movzx eax, byte [rdx + 8]
mov byte [rcx + 8], al
movzx eax, byte [rdx + 9]
mov byte [rcx + 9], al
movzx eax, byte [rdx + 0xa]
mov byte [rcx + 0xa], al
movzx eax, byte [rdx + 0xb]
mov byte [rcx + 0xb], al
movzx eax, byte [rdx + 0xc]
mov byte [rcx + 0xc], al
movzx eax, byte [rdx + 0xd]
mov byte [rcx + 0xd], al
movzx eax, byte [rdx + 0xe]
mov byte [rcx + 0xe], al
movzx eax, byte [rdx + 0xf]
mov byte [rcx + 0xf], al
mov eax, 4
lea rdx, str.cw
lea r8, [0x180003100]
jmp 0x1800010a8
movd xmm1, dword [rcx + rax*4 - 0x10]
pxor xmm1, xmm0
movd dword [rcx + rax*4], xmm1
inc rax
cmp rax, 0x2c
je 0x180001109
movd xmm0, dword [rcx + rax*4 - 4]
test al, 3
jne 0x180001090
movdqa xmmword [rsp], xmm0
movzx r9d, byte [rsp + 1]
movzx r10d, byte [rsp + 2]
movzx r11d, byte [rsp + 3]
movzx r11d, byte [r11 + rdx]
movzx esi, byte [rsp]
mov edi, eax
shr edi, 2
movzx ebx, byte [rdi + r8]
xor bl, byte [r9 + rdx]
movzx r9d, byte [rsi + rdx]
shl r9d, 8
or r9d, r11d
movzx r10d, byte [r10 + rdx]
shl r10d, 8
movzx r11d, bl
or r11d, r10d
movd xmm0, r11d
pinsrw xmm0, r9d, 1
jmp 0x180001090
add rsp, 0x10
pop rbx
pop rdi
pop rsi
ret
Function at 0x180001730
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x1800050c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
test r8, r8
je 0x18000185b
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea r14, [rcx + 0xb0]
xor r15d, r15d
nop word cs:[rax + rax]
lea rcx, [rdi + r15]
movups xmm0, xmmword [rdi + r15]
movaps xmmword [rsp + 0x20], xmm0
mov rdx, rbx
call fcn.180001150
movzx eax, byte [rbx + 0xb0]
xor byte [rdi + r15], al
movzx eax, byte [rbx + 0xb1]
xor byte [rdi + r15 + 1], al
movzx eax, byte [rbx + 0xb2]
xor byte [rdi + r15 + 2], al
movzx eax, byte [rbx + 0xb3]
xor byte [rdi + r15 + 3], al
movzx eax, byte [rbx + 0xb4]
xor byte [rdi + r15 + 4], al
movzx eax, byte [rbx + 0xb5]
xor byte [rdi + r15 + 5], al
movzx eax, byte [rbx + 0xb6]
xor byte [rdi + r15 + 6], al
movzx eax, byte [rbx + 0xb7]
xor byte [rdi + r15 + 7], al
movzx eax, byte [rbx + 0xb8]
xor byte [rdi + r15 + 8], al
movzx eax, byte [rbx + 0xb9]
xor byte [rdi + r15 + 9], al
movzx eax, byte [rbx + 0xba]
xor byte [rdi + r15 + 0xa], al
movzx eax, byte [rbx + 0xbb]
xor byte [rdi + r15 + 0xb], al
movzx eax, byte [rbx + 0xbc]
xor byte [rdi + r15 + 0xc], al
movzx eax, byte [rbx + 0xbd]
xor byte [rdi + r15 + 0xd], al
movzx eax, byte [rbx + 0xbe]
xor byte [rdi + r15 + 0xe], al
movzx eax, byte [rbx + 0xbf]
xor byte [rdi + r15 + 0xf], al
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [r14], xmm0
add r15, 0x10
cmp r15, rsi
jb 0x180001770
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001de0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180001920
Capabilities:
Enumerate processes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rdi, rcx
mov rax, qword [0x1800050c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x28], 0x238
xor esi, esi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x180001a70
mov rbx, rax
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
lea r14, [rsp + 0x54]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [rdi + 0x10]
cmp rax, rcx
mov rdx, rcx
cmovb rdx, rax
test rdx, rdx
je 0x1800019c5
cmp qword [rdi + 0x18], 8
mov r8, rdi
jb 0x18000199f
mov r8, qword [rdi]
xor r9d, r9d
nop word cs:[rax + rax]
movzx r10d, word [r8 + r9*2]
cmp r10w, word [rsp + r9*2 + 0x54]
jne 0x1800019f4
inc r9
cmp rdx, r9
jne 0x1800019b0
cmp rax, rcx
jne 0x1800019f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x30]
jmp 0x180001a70
xor edx, edx
cmp rax, rcx
setb dl
mov eax, 0xffffffff
cmovbe eax, edx
test eax, eax
je 0x1800019ca
lea rdx, [rsp + 0x28]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x180001a67
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [rdi + 0x10]
cmp rax, rcx
mov rdx, rcx
cmovb rdx, rax
test rdx, rdx
je 0x1800019e0
cmp qword [rdi + 0x18], 8
mov r8, rdi
jb 0x180001a2e
mov r8, qword [rdi]
xor r9d, r9d
nop word cs:[rax + rax]
movzx r10d, word [r8 + r9*2]
cmp r10w, word [rsp + r9*2 + 0x54]
jne 0x180001a60
inc r9
cmp rdx, r9
jne 0x180001a40
jmp 0x1800019e0
mov eax, 1
jmp 0x1800019f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180001de0
mov eax, esi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x180001ca0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180001cdc
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x180001a90]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180001cdc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1405c4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405c41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405c4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405c406f
add dl, dl
jne 0x1405c4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405c40f6
xor eax, eax
add dl, dl
jne 0x1405c40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405c41ad
add dl, dl
jne 0x1405c40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405c40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405c40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405c40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405c40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405c407e
mov eax, 1
add dl, dl
jne 0x1405c4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405c4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405c40fb
sub eax, ebx
mov ebx, 1
jne 0x1405c414c
mov ecx, 1
add dl, dl
jne 0x1405c412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405c413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405c4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405c407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405c4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405c4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405c415d
cmp eax, 0x7d00
jae 0x1405c419b
cmp eax, 0x500
jb 0x1405c4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405c407e
cmp eax, 0x7f
ja 0x1405c419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405c407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405c41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405c407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001168
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.1400018e4
add rsp, 0x28
jmp 0x140001168
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x14000cb78], rbx
je 0x1400011b2
cmp rax, rbx
jne 0x1400011ca
mov edi, 1
mov eax, dword [0x14000cb80]
cmp eax, 1
jne 0x1400011d7
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x14000124e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000119b
mov eax, dword [0x14000cb80]
test eax, eax
jne 0x140001244
mov dword [0x14000cb80], 1
lea r14, [0x1400096d0]
lea rbx, [0x1400096b8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x140001236
test eax, eax
jne 0x14000123a
cmp qword [rbx], 0
je 0x14000122b
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [0x140009688]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140001202
or eax, eax
je 0x14000124e
mov eax, 0xff
jmp 0x1400013ab
mov dword [0x14000c224], 1
mov eax, dword [0x14000cb80]
cmp eax, 1
jne 0x140001276
lea rdx, [0x1400096b0]
lea rcx, [0x1400096a0]
call sub.msvcrt.dll__initterm
mov dword [0x14000cb80], 2
test edi, edi
jne 0x140001283
sub eax, eax
xchg qword [0x14000cb78], rax
cmp qword [0x14000cb88], 0
je 0x1400012c1
lea rcx, [0x14000cb88]
call fcn.140001850
test eax, eax
je 0x1400012c1
movabs r10, 0x99012e4578d92870
sub r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000cb88]
mov r9, qword [0x140009688]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x14000134d
test cl, cl
je 0x1400012e4
test edi, edi
jne 0x14000134d
dec cl
cmp cl, 0x1f
ja 0x1400012f7
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x1400012e4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
sub edx, edx
lea rcx, [0x140000000]
call fcn.140007fe4
mov dword [0x14000c220], eax
cmp dword [0x14000c240], 0
jne 0x140001336
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000c224], 0
jne 0x14000134b
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000c220]
jmp 0x1400013ab
cmp cl, 0x22
jne 0x14000135f
sub eax, eax
or edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x140001371
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x1400012d4
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x140001404
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
nop
push rbx
pop rcx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push rax
pop rcx
nop
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14000173c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
sub edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001788
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001780
cmp dword [rcx + 0x3c], edx
jl 0x140001780
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001780
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
push rax
nop
pop rdx
mov qword [rsp], rax
jmp 0x140001788
nop
push rdx
pop rax
add rsp, 0x18
ret

Function at 0x140001800
Capabilities:
Enumerate pe sections

Disassembly:
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test r11d, r11d
je 0x140001841
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x140001835
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x140001843
inc r9d
add rax, 0x28
cmp r9d, r11d
jb 0x140001823
sub eax, eax
ret

Function at 0x1400018b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400018d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400018d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400022f0
Capabilities:
Get file version info

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
nop
push rsp
pop rbp
sub rsp, 0x48
xor r15d, r15d
mov r12, r9
mov r14, rdx
mov r13, rcx
mov edi, r15d
mov dword [rbp + 0x58], r15d
mov ebx, r15d
cmp dword [rcx + 0x7c], r15d
jle 0x1400024f2
mov eax, r15d
mov qword [rbp - 0x18], rax
mov esi, dword [r13 + 0x80]
lea r8, [r13 + 0x84]
add rsi, rax
mov rcx, r14
mov eax, dword [rsi + r13 + 0xbc]
add r8, rax
call fcn.140002d34
test eax, eax
je 0x14000250b
lea rdx, [rbp + 0x48]
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
nop dword [rax + rax]
mov r14d, eax
or eax, eax
je 0x1400024c2
mov edx, r14d
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
push rax
nop
pop rdi
or rax, rax
je 0x140002502
push rax
nop
pop rcx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x1400024f9
mov edx, dword [rbp + 0x48]
mov r8d, r14d
mov r14, qword [rbp + 0x50]
mov r9, rax
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
nop dword [rax + rax]
or eax, eax
je 0x1400024ae
lea r9, [rbp + 0x60]
mov rcx, r15
lea r8, [rbp - 0x10]
lea rdx, [0x14000988c]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
nop dword [rax + rax]
xor r15d, r15d
test eax, eax
je 0x1400024b1
cmp dword [rbp + 0x60], r15d
je 0x1400024b1
mov rax, qword [rbp - 0x10]
lea rcx, [r13 + 0x90]
add rcx, rsi
mov edx, r15d
mov r9d, dword [rax + 0xc]
mov r8d, dword [rax + 8]
cmp r8d, dword [rcx - 0xc]
jae 0x140002434
or eax, 0xffffffff
jmp 0x140002449
jbe 0x14000243d
mov eax, 1
jmp 0x140002449
cmp r9d, dword [rcx - 8]
jb 0x14000242f
mov eax, r15d
seta al
mov dword [rbp + rdx - 0x28], eax
cmp r8d, dword [rcx]
jae 0x140002457
or eax, 0xffffffff
jmp 0x14000246c
jbe 0x140002460
mov eax, 1
jmp 0x14000246c
cmp r9d, dword [rcx + 4]
jb 0x140002452
mov eax, r15d
seta al
mov dword [rbp + rdx - 0x20], eax
add rcx, 0x18
add rdx, 4
cmp rdx, 8
jl 0x140002429
cmp dword [rbp - 0x28], r15d
jl 0x14000248a
cmp dword [rbp - 0x20], r15d
jle 0x1400024b1
cmp dword [rbp - 0x24], r15d
jl 0x140002496
cmp dword [rbp - 0x1c], r15d
jle 0x1400024b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop dword [rax + rax]
mov dword [r12], ebx
mov esi, r15d
jmp 0x140002517
xor r15d, r15d
push rdi
pop rcx
nop
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop dword [rax + rax]
jmp 0x1400024da
cmp dword [rsi + r13 + 0x84], r15d
jne 0x14000250b
cmp dword [rsi + r13 + 0x88], r15d
jne 0x14000250b
mov r14, qword [rbp + 0x50]
mov rax, qword [rbp - 0x18]
inc ebx
add rax, 0x3c
mov qword [rbp - 0x18], rax
cmp ebx, dword [r13 + 0x7c]
jl 0x140002334
mov esi, 1
jmp 0x14000250e
mov esi, dword [rbp + 0x58]
mov dword [r12], ebx
jmp 0x140002517
mov esi, dword [rbp + 0x58]
mov dword [r12], ebx
jmp 0x140002526
mov esi, dword [rbp + 0x58]
mov dword [r12], ebx
or rdi, rdi
je 0x140002526
push rdi
nop
pop rcx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, esi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400026b8
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
test rcx, rcx
je 0x1400028ae
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x170], rax
cmp byte [rcx], 0
mov rbx, rcx
je 0x140002888
mov r15d, 0x104
lea rax, [rbp + 0x60]
push rbx
pop rdi
nop
lea rcx, [rbp + 0x60]
mov edx, r15d
sub rdi, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002730
mov al, byte [rdi + rcx]
test al, al
je 0x140002730
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140002712
or rdx, rdx
lea rax, [rcx - 1]
lea r8, [0x140009838]
mov rdx, r15
cmovne rax, rcx
lea rcx, [rbp + 0x60]
mov byte [rax], 0
call fcn.1400035a8
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
nop dword [rax + rax]
nop
push rax
pop rsi
cmp rax, 0xffffffffffffffff
je 0x140002888
mov r8, r15
lea rdx, [rbp + 0x60]
lea rcx, [r8 + 0x7ffffefa]
test rcx, rcx
je 0x140002798
mov al, byte [rdi + rdx]
test al, al
je 0x140002798
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x14000277a
test r8, r8
lea rax, [rdx - 1]
cmovne rax, rdx
test byte [rsp + 0x20], 0x10
mov byte [rax], 0
je 0x140002818
lea rdx, [0x14000983c]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
nop dword [rax + rax]
or eax, eax
je 0x14000284e
lea rdx, [0x140009840]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
nop dword [rax + rax]
or eax, eax
je 0x14000284e
lea r8, [rsp + 0x4c]
mov rdx, r15
lea rcx, [rbp + 0x60]
call fcn.1400035a8
lea r8, [0x140009770]
mov edx, r15d
lea rcx, [rbp + 0x60]
call fcn.14000887c
lea rcx, [rbp + 0x60]
call fcn.1400026b8
jmp 0x14000284e
lea r8, [rsp + 0x4c]
mov rdx, r15
lea rcx, [rbp + 0x60]
call fcn.1400035a8
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop dword [rax + rax]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop dword [rax + rax]
test eax, eax
jne 0x140002773
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
push rbx
pop rcx
nop
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400013e0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x140002d34
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x50], rax
sub edi, edi
mov rsi, r8
mov byte [rcx], dil
push rcx
nop
pop rbx
cmp byte [r8], 0x23
lea r12d, [rdi + 1]
jne 0x140002f3d
add rsi, r12
movsx rcx, byte [rsi]
call qword [sym.imp.USER32.dll_CharUpperA]
nop dword [rax + rax]
push rsi
pop rcx
nop
mov r14, rax
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
push rax
nop
pop rcx
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
push rax
pop rsi
nop
cmp r14b, 0x41
je 0x140002dee
cmp r14b, 0x53
je 0x140002dd5
cmp r14b, 0x57
jne 0x140002dee
mov edx, 0x104
push rbx
pop rcx
nop
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
jmp 0x140002f37
mov edx, 0x104
push rbx
nop
pop rcx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
jmp 0x140002f37
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
mov dword [rsp + 0x34], 0x104
lea rax, [rsp + 0x40]
mov edx, 0x104
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002e2d
mov al, byte [r8 + rcx]
test al, al
je 0x140002e2d
mov byte [rcx], al
add rcx, r12
sub rdx, r12
jne 0x140002e0f
or rdx, rdx
lea rax, [rcx - 1]
mov r8, rsi
mov edx, 0x104
cmovne rax, rcx
lea rcx, [rsp + 0x40]
mov byte [rax], dil
call fcn.14000887c
lea rax, [rsp + 0x38]
mov r9d, 0x20019
sub r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
or eax, eax
jne 0x140002f37
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x140009770]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
or eax, eax
jne 0x140002f26
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x140002f1f
mov r8d, 0x104
lea rdx, [rsp + 0x40]
push rbx
nop
pop rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
nop dword [rax + rax]
test eax, eax
je 0x140002f1b
lea r8, [rsp + 0x40]
mov edx, 0x104
sub r8, rbx
push rbx
pop rcx
nop
lea rax, [rdx + 0x7ffffefa]
or rax, rax
je 0x140002f08
mov al, byte [r8 + rcx]
test al, al
je 0x140002f08
mov byte [rcx], al
add rcx, r12
sub rdx, r12
jne 0x140002eea
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], dil
mov edi, r12d
jmp 0x140002f26
mov eax, dword [rsp + 0x30]
cmp eax, r12d
cmove edi, r12d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
or edi, edi
jne 0x140002f5e
jmp 0x140002f4e
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
mov r8, rsi
mov edx, 0x104
nop
push rbx
pop rcx
call fcn.14000887c
mov eax, r12d
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400013e0
mov rbx, qword [rsp + 0x198]
add rsp, 0x160
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret