joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140061b34
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x1060
call fcn.1400baa60
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
cmp rdx, rcx
je 0x140061b73
mov rdx, rcx
mov rcx, rbx
call fcn.14006b658
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareWinRARGeneral
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r12d, r12d
cmp eax, r12d
jne 0x140061c80
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
mov eax, 0x3ff
lea r9, [rsp + 0x40]
not rcx
lea rdx, str.LanguageFolder
xor r8d, r8d
dec rcx
sub eax, ecx
mov rcx, qword [rsp + 0x38]
add eax, eax
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x850]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x140061c75
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x850]
mov r8d, 0x400
mov word [rsp + 0x50], r12w
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0x50]
call fcn.140052588
mov rcx, rsi
call fcn.140052af8
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
mov r11, rax
xor eax, eax
repne scasw ax, word [rdi]
xor r9d, r9d
movzx edx, word [r11 + r9]
add r9, 2
mov word [rdi + r9 - 4], dx
test dx, dx
jne 0x140061c40
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.1400310fc
cmp al, r12b
je 0x140061c75
lea rdx, [rsp + 0x50]
mov r8, rbp
mov rcx, rbx
call fcn.14006b658
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1400a86e0
add rsp, 0x1060
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140061e54
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x950
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x940], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
call fcn.140061b00
xor ebp, ebp
cmp rbx, rbp
je 0x140061eb0
lea r8, [rsp + 0x140]
sub r8, rbx
movzx eax, word [rbx]
mov word [r8 + rbx], ax
add rbx, 2
cmp ax, bp
jne 0x140061e9d
jmp 0x140061ec6
lea rdx, [rsp + 0x140]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x140]
lea rbx, str.rarlng.dll
call fcn.140052af8
movzx ecx, word [rbx]
add rbx, 2
mov word [rax], cx
add rax, 2
cmp cx, bp
jne 0x140061eda
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x140]
mov r8d, 0x400
call fcn.140061b34
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x140061f48
cmp dword [rsp + 0x24], 5
ja 0x140061f32
jne 0x140061f48
cmp dword [rsp + 0x28], 1
jbe 0x140061f48
xor edx, edx
lea rcx, [rsp + 0x140]
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x140061f56
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, rbp
mov qword [0x1400ec660], rax
setne cl
mov byte [rsi], cl
mov rax, qword [0x1400ec660]
cmp cl, bpl
cmove rax, rdi
mov qword [0x1400ec658], rdi
mov qword [0x1400ec660], rax
mov rcx, qword [rsp + 0x940]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0x950]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140061fac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x20
call fcn.1400a8fe0
xor r11d, r11d
xor r10d, r10d
xor edx, edx
xor r8d, r8d
xor r9d, r9d
cmp r9, 0x28
jg 0x140062033
cmp rdx, 4
jge 0x14006201a
lea rbx, [rsp + rdx*4 + 0x20]
cmp r8, 4
jge 0x14006201e
mov eax, dword [rbx]
lea rcx, [r9 + r8]
inc rdx
add rbx, 4
inc r10d
inc r8
cmp rdx, 4
mov dword [rdi + rcx*4 + 0x14], eax
jl 0x140061ff7
cmp r8, 4
jne 0x14006202d
inc r11d
add r9, 4
xor r10d, r10d
xor r8d, r8d
cmp rdx, 4
jl 0x140061fe6
movsxd r8, r11d
movsxd r9, r10d
cmp r8, 0xa
jg 0x140062102
lea r11, [0x14011ce70]
lea rbx, [0x14011cf90]
movzx eax, byte [rsp + 0x2d]
mov cl, byte [rsp + 0x20]
lea rdx, [rsp + 0x24]
xor cl, byte [rax + rbx]
movzx eax, byte [rsp + 0x2e]
mov r10d, 3
mov al, byte [rax + rbx]
xor cl, byte [r11]
xor byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x2f]
mov byte [rsp + 0x20], cl
mov al, byte [rax + rbx]
xor byte [rsp + 0x22], al
movzx eax, byte [rsp + 0x2c]
mov al, byte [rax + rbx]
xor byte [rsp + 0x23], al
inc r11
xor ecx, ecx
mov al, byte [rdx + rcx - 4]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jl 0x140062098
add rdx, 4
sub r10, 1
jne 0x140062096
xor edx, edx
cmp r8, 0xa
jg 0x140062102
cmp rdx, 4
jge 0x1400620e6
lea r10, [rsp + rdx*4 + 0x20]
cmp r9, 4
jge 0x1400620ea
mov eax, dword [r10]
lea rcx, [r9 + r8*4]
inc rdx
add r10, 4
inc r9
cmp rdx, 4
mov dword [rdi + rcx*4 + 0x14], eax
jl 0x1400620c5
cmp r9, 4
jne 0x1400620f2
inc r8
xor r9d, r9d
cmp rdx, 4
jl 0x1400620b4
cmp r8, 0xa
jle 0x140062051
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a86e0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x14006211c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x10], rax
lea r10, [rcx + 0x24]
mov r11d, 9
lea r13, [0x140000000]
xor r9d, r9d
lea rsi, [rsp + r9]
lea rdi, [r10 + 2]
mov ebp, 4
movzx eax, byte [rdi + 1]
lea rdx, [r9 + rax*4]
movzx eax, byte [rdi - 1]
mov r8b, byte [rdx + r13 + 0x119e70]
lea rcx, [r9 + rax*4]
movzx eax, byte [rdi - 2]
xor r8b, byte [rcx + r13 + 0x11a670]
lea rcx, [r9 + rax*4]
movzx eax, byte [rdi]
xor r8b, byte [rcx + r13 + 0x11aa70]
lea rcx, [r9 + rax*4]
add rdi, 4
xor r8b, byte [rcx + r13 + 0x11a270]
mov byte [rsi], r8b
add rsi, 4
sub rbp, 1
jne 0x14006215e
inc r9
cmp r9, 4
jl 0x140062151
movdqu xmm0, xmmword [rsp]
movdqu xmmword [r10], xmm0
add r10, 0x10
sub r11, 1
jne 0x14006214e
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.1400a86e0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
Function at 0x140062e54
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
jmp 0x140062e54
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, r9
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
test r8, r8
jne 0x140062e86
xor eax, eax
jmp 0x140062f2e
mov eax, dword [rdx]
mov r8, rbx
shr rsi, 4
xor eax, dword [rcx + 4]
mov dword [rsp + 0x20], eax
mov eax, dword [rdx + 4]
xor eax, dword [rcx + 8]
mov dword [rsp + 0x24], eax
mov eax, dword [rdx + 8]
xor eax, dword [rcx + 0xc]
mov dword [rsp + 0x28], eax
mov eax, dword [rdx + 0xc]
lea rdx, [rsp + 0x20]
xor eax, dword [rcx + 0x10]
mov dword [rsp + 0x2c], eax
call fcn.1400621ec
lea r12, [rsi - 1]
add rbp, 0x10
test r12, r12
je 0x140062f10
mov eax, dword [rbx]
add rbx, 0x10
lea rdx, [rsp + 0x20]
xor eax, dword [rbp]
mov r8, rbx
mov rcx, rdi
mov dword [rsp + 0x20], eax
mov eax, dword [rbx - 0xc]
xor eax, dword [rbp + 4]
mov dword [rsp + 0x24], eax
mov eax, dword [rbx - 8]
xor eax, dword [rbp + 8]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx - 4]
xor eax, dword [rbp + 0xc]
mov dword [rsp + 0x2c], eax
call fcn.1400621ec
add rbp, 0x10
sub r12, 1
jne 0x140062ecb
mov eax, dword [rbx]
shl rsi, 4
mov dword [rdi + 4], eax
mov eax, dword [rbx + 4]
mov dword [rdi + 8], eax
mov eax, dword [rbx + 8]
mov dword [rdi + 0xc], eax
mov eax, dword [rbx + 0xc]
mov dword [rdi + 0x10], eax
mov rax, rsi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a86e0
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140062f48
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
jmp 0x140062f48
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x14006304e
test rbx, rbx
je 0x14006304e
movdqu xmm0, xmmword [rcx + 4]
shr rbx, 4
mov qword [rsp + 0x20], rbx
mov r12, rbx
movdqu xmmword [rsp + 0x28], xmm0
test rbx, rbx
je 0x140063040
mov r13d, dword [r11 - 0x54]
mov r14d, dword [r11 - 0x58]
mov r15d, dword [r11 - 0x5c]
mov ebx, dword [rsp + 0x28]
lea r8, [rsp + 0x38]
mov rdx, rsi
mov rcx, rdi
call fcn.14006261c
mov r11d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x44]
xor r11d, ebx
mov ebx, dword [rsi]
xor edx, r15d
mov r15d, dword [rsi + 4]
xor ecx, r14d
mov r14d, dword [rsi + 8]
xor eax, r13d
mov r13d, dword [rsi + 0xc]
mov dword [rbp], r11d
mov dword [rbp + 4], edx
mov dword [rbp + 8], ecx
mov dword [rbp + 0xc], eax
add rbp, 0x10
add rsi, 0x10
sub r12, 1
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x3c], edx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x44], eax
jne 0x140062fbb
mov dword [rsp + 0x28], ebx
mov rbx, qword [rsp + 0x20]
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x2c], r15d
movdqu xmm0, xmmword [rsp + 0x28]
shl rbx, 4
movdqu xmmword [rdi + 4], xmm0
mov rax, rbx
jmp 0x140063050
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a86e0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006547c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rcx, rdx
lea rdx, [0x1400c378c]
call fcn.140086cc4
xor esi, esi
mov rdi, rax
cmp rax, rsi
je 0x140065689
lea r14d, [rsi + 1]
lea edx, [rsi + 0x16]
lea rcx, [rsp + 0x38]
mov r8, r14
mov r9, rax
call fcn.1400aa184
cmp word [rsp + 0x38], si
jne 0x140065681
cmp word [rsp + 0x3a], r14w
jne 0x140065681
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400aa484
movzx r11d, word [rsp + 0x3c]
sub r11d, r14d
movsxd rcx, r11d
shl rcx, 4
add rcx, 0x16
call fcn.1400a879c
movzx ecx, word [rsp + 0x3c]
sub ecx, r14d
mov r15, rax
movsxd rcx, ecx
imul rcx, rcx, 0xe
add rcx, 0x14
call fcn.1400a879c
movzx ecx, word [rsp + 0x3c]
mov r9, rdi
sub ecx, r14d
mov r8, r14
mov r13, rax
movsxd rdx, ecx
mov rcx, r15
shl rdx, 4
add rdx, 0x16
call fcn.1400aa184
mov rcx, qword [r15]
mov ebp, esi
mov qword [r13], rcx
mov rax, qword [r15 + 8]
mov qword [r13 + 8], rax
mov eax, dword [r15 + 0x10]
mov dword [r13 + 0x10], eax
cmp si, word [rsp + 0x3c]
jae 0x140065635
movsxd rcx, ebp
lea r12d, [r14 + rbp]
mov rbx, rcx
add rbx, rbx
imul rcx, rcx, 0xe
mov rax, qword [r15 + rbx*8 + 6]
mov qword [rcx + r13 + 6], rax
mov eax, dword [r15 + rbx*8 + 0xe]
mov word [rcx + r13 + 0x12], r12w
mov dword [rcx + r13 + 0xe], eax
mov eax, dword [r15 + rbx*8 + 0xe]
mov rcx, rax
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x30], rax
call fcn.1400a879c
mov rcx, rdi
mov r14, rax
cmp rax, rsi
je 0x140065684
mov edx, dword [r15 + rbx*8 + 0x12]
xor r8d, r8d
call fcn.1400aa484
mov rdx, qword [rsp + 0x30]
mov r9, rdi
mov r8d, 1
mov rcx, r14
call fcn.1400aa184
mov eax, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x28], eax
mov r9d, 0x400
movzx r8d, r12w
mov edx, 3
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
mov rcx, r14
mov ebx, eax
call fcn.1400a8854
cmp ebx, esi
je 0x140065681
movzx eax, word [rsp + 0x3c]
mov r14d, 1
add ebp, r14d
cmp ebp, eax
jl 0x14006556e
mov rcx, rdi
call fcn.1400aa5c0
movzx r11d, word [rsp + 0x3c]
movzx r8d, word [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
sub r11d, r14d
mov r9d, 0x400
mov edx, 0xe
imul r11d, r11d, 0xe
add r11d, 0x14
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
cmp eax, esi
setne al
jmp 0x14006568b
mov rcx, rdi
call fcn.1400aa5c0
xor al, al
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400656a4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rax, rdx
mov r12, rcx
lea rdx, [0x1400c378c]
mov rcx, rax
mov ebp, r8d
call fcn.140086cc4
xor esi, esi
mov rbx, rax
cmp rax, rsi
je 0x140065770
mov rcx, rax
call fcn.1400ac4dc
cmp eax, 0x42
jne 0x140065768
mov rcx, rbx
call fcn.1400ac4dc
cmp eax, 0x4d
jne 0x140065768
lea edx, [rsi + 2]
xor r8d, r8d
mov rcx, rbx
call fcn.1400aa484
lea edx, [rsi + 4]
lea r8d, [rsi + 1]
lea rcx, [rsp + 0x68]
mov r9, rbx
call fcn.1400aa184
mov r11d, dword [rsp + 0x68]
add r11d, 0xfffffff2
mov ecx, r11d
mov dword [rsp + 0x68], r11d
call fcn.1400a879c
mov rcx, rbx
mov rdi, rax
cmp rax, rsi
je 0x14006576b
lea edx, [rsi + 0xe]
xor r8d, r8d
call fcn.1400aa484
mov r8d, dword [rsp + 0x68]
lea edx, [rsi + 1]
mov r9, rbx
mov rcx, rdi
call fcn.1400aa184
mov ecx, dword [rsp + 0x68]
cmp rax, rcx
je 0x140065785
mov rcx, rdi
call fcn.1400a8854
mov rcx, rbx
call fcn.1400aa5c0
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.1400aa5c0
mov ecx, dword [rsp + 0x68]
mov r9d, 0x400
mov dword [rsp + 0x28], ecx
movzx r8d, bp
mov edx, 2
mov rcx, r12
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
mov rcx, rdi
mov ebx, eax
call fcn.1400a8854
cmp ebx, esi
setne al
jmp 0x140065772

Function at 0x140065808
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x420], rax
lea rdx, [0x1400c378c]
call fcn.140086cc4
xor edi, edi
mov rsi, rax
cmp rax, rdi
jne 0x140065846
mov al, 1
jmp 0x140065897
lea rcx, [rsp + 0x20]
mov r9, rax
mov edx, 1
mov r8d, 0x400
call fcn.1400aa184
mov rcx, rsi
mov rbx, rax
call fcn.1400aa5c0
lea ecx, [rbx - 4]
cmp ecx, edi
jle 0x140065895
lea rax, [rsp + 0x21]
cmp byte [rax - 1], 0x55
jne 0x14006588c
cmp byte [rax], 0x50
jne 0x14006588c
cmp byte [rax + 1], 0x58
jne 0x14006588c
cmp byte [rax + 2], 0x30
je 0x140065842
inc edi
inc rax
cmp edi, ecx
jl 0x140065875
xor al, al
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400658bc
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2030
call fcn.1400baa60
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rdi, rdx
lea rdx, [0x1400c378c]
call fcn.140086cc4
mov rbx, rax
test rax, rax
je 0x140065940
mov r9, rax
mov esi, 1
jmp 0x14006591d
lea rcx, [rsp + 0x20]
mov r9, rdi
mov r8, rax
mov rdx, rsi
call fcn.1400aa848
mov r9, rbx
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
mov rdx, rsi
call fcn.1400aa184
test rax, rax
jne 0x140065907
mov rcx, rbx
call fcn.1400aa5c0
mov al, sil
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140065968
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2030
call fcn.1400baa60
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r14, rdx
lea rdx, [0x1400c378c]
mov r15, r8
call fcn.140086cc4
mov rsi, rax
test rax, rax
je 0x140065adc
xor r13d, r13d
mov r9, rax
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
mov edx, 1
call fcn.1400aa184
mov r12, rax
cmp rax, 0x28
jbe 0x140065ad4
lea rbp, [rax - 0x28]
xor edi, edi
test rbp, rbp
je 0x140065a87
lea rbx, [rsp + 0x24]
cmp byte [rsp + rdi + 0x20], 0x2a
jne 0x140065a1e
cmp byte [rsp + rdi + 0x21], 0x2a
jne 0x140065a1e
lea rcx, [rsp + rdi + 0x22]
lea rdx, str.messages
mov r8d, 0xc
call fcn.1400aaa7c
test eax, eax
je 0x140065aa2
cmp word [rbx - 4], 0x2a
jne 0x140065a45
cmp word [rbx - 2], 0x2a
jne 0x140065a45
lea rdx, [0x1400c89b0]
mov r8d, 0xc
mov rcx, rbx
call fcn.1400ab1b4
test eax, eax
je 0x140065aa2
mov eax, 0xfeff
cmp word [rbx - 4], ax
jne 0x140065a77
cmp word [rbx - 2], 0x2a
jne 0x140065a77
cmp word [rbx], 0x2a
jne 0x140065a77
lea rcx, [rbx + 2]
lea rdx, [0x1400c89b0]
mov r8d, 0xc
call fcn.1400ab1b4
test eax, eax
je 0x140065aa2
inc rdi
add rbx, 2
cmp rdi, rbp
jb 0x1400659f1
lea r13d, [r13 + r12 - 0x28]
xor r8d, r8d
mov rcx, rsi
mov edx, r13d
call fcn.1400aa484
mov r9, rsi
jmp 0x1400659bb
lea edx, [rdi + r13]
xor r8d, r8d
mov rcx, rsi
call fcn.1400aa484
mov r9, rsi
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.1400aa184
mov rcx, rsi
mov rbx, rax
call fcn.1400aa5c0
mov rax, rbx
jmp 0x140065ade
mov rcx, rsi
call fcn.1400aa5c0
xor eax, eax
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400a86e0
mov rbx, qword [rsp + 0x2088]
add rsp, 0x2030
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140065b0c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x2030
call fcn.1400baa60
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x2020], rax
lea rdx, [0x1400c8b90]
call fcn.140086cc4
mov rdi, rax
test rax, rax
je 0x140065c1c
xor r13d, r13d
mov r9, rax
lea r14d, [r13 + 1]
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
mov rdx, r14
call fcn.1400aa184
mov r12, rax
cmp rax, 0x20
jbe 0x140065c14
lea ebp, [r12 - 0x20]
xor esi, esi
test ebp, ebp
jle 0x140065bc2
lea rbx, [rsp + 0x21]
cmp byte [rbx - 1], 0x61
jne 0x140065bb8
cmp byte [rbx], 0x73
jne 0x140065bb8
movsxd rax, esi
lea rdx, str.Invoker_
mov r8d, 0x14
lea rcx, [rsp + rax + 0x22]
call fcn.1400aaa7c
test eax, eax
je 0x140065bda
add esi, r14d
add rbx, r14
cmp esi, ebp
jl 0x140065b8f
lea r13d, [r13 + r12 - 0x20]
xor r8d, r8d
mov rcx, rdi
mov edx, r13d
call fcn.1400aa484
mov r9, rdi
jmp 0x140065b5f
lea edx, [rsi + r13]
xor r8d, r8d
mov rcx, rdi
call fcn.1400aa484
lea rcx, str.requireAdministrator_
mov r9, rdi
mov r8d, 0x15
mov rdx, r14
call fcn.1400aa848
mov rcx, rdi
cmp rax, 0x15
sete bl
call fcn.1400aa5c0
mov al, bl
jmp 0x140065c1e
mov rcx, rdi
call fcn.1400aa5c0
xor al, al
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140065fdc
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x28
mov r8, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x1400c64b8]
call fcn.14005c410
mov r11, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x800]
lea rdx, str.PathType
call fcn.14005c428
mov r11, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x804]
lea rdx, str.SavePath
call fcn.14005c428
mov r8, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.Setup
add r8, 0x806
call fcn.14005c410
mov r8, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.Presetup
add r8, 0x1006
call fcn.14005c410
mov r11, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x1806]
lea rdx, str.TempMode
call fcn.14005c428
mov r8, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.TempModeQuestion
add r8, 0x1808
call fcn.14005c410
mov r8, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.TempModeTitle
add r8, 0x2008
call fcn.14005c410
mov r11, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x2208]
lea rdx, str.Silent
call fcn.14005c428
mov r11, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x220c]
lea rdx, str.Overwrite
call fcn.14005c428
mov r11, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x2211]
lea rdx, str.UpdateFiles
call fcn.14005c428
mov r11, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x2210]
lea rdx, str.FreshFiles
call fcn.14005c428
mov r8, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.DelFiles
add r8, 0x2212
call fcn.14005c410
mov r8, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.Title
add r8, 0x4212
call fcn.14005c410
mov r8, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x1400c8c28]
add r8, 0x4412
call fcn.14005c410
mov r8, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.LicenseTitle
add r8, 0x24412
call fcn.14005c410
mov r8, qword [0x14011d2f8]
add r8, 0x24612
mov rcx, qword [str.SFXDefault]
lea rdx, str.LicenseText
call fcn.14005c410
mov r8, qword [0x14011d2f8]
mov rcx, qword [str.SFXDefault]
lea rdx, str.ShortcutText
add r8, 0x44612
call fcn.14005c410
mov rcx, qword [str.SFXDefault]
lea r8, [0x14010ceba]
lea rdx, str.SFXLogo
call fcn.14005c410
mov rcx, qword [str.SFXDefault]
lea r8, [0x14010c6ba]
lea rdx, str.SFXIcon
call fcn.14005c410
movzx r8d, byte [0x14010d6ba]
mov rcx, qword [str.SFXDefault]
lea rdx, str.SFXElevate
call fcn.14005c428
mov rcx, qword [str.SFXDefault]
lea r8, [0x140108b70]
lea rdx, str.SFXModule
add rsp, 0x28
jmp fcn.14005c410
Function at 0x140066afc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2030
call fcn.1400baa60
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x2020], rax
lea rdx, [0x1400c378c]
xor r8d, r8d
call fcn.140031a0c
mov rsi, rax
test rax, rax
je 0x140066be5
xor r12d, r12d
xor r13d, r13d
lea ebx, [r12 + 1]
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8d, 0x2000
mov rdx, rbx
call fcn.1400aa184
cmp eax, 0x20
mov r15, rax
jle 0x140066bd9
lea r14d, [rax - 0x20]
xor ebp, ebp
test r14d, r14d
jle 0x140066bba
lea rdi, [rsp + 0x21]
cmp byte [rdi - 1], 0x72
jne 0x140066bb0
cmp byte [rdi], 0x65
jne 0x140066bb0
movsxd rax, ebp
lea rdx, str.quireAdministrator_
mov r8d, 0x14
lea rcx, [rsp + rax + 0x22]
call fcn.1400aaa7c
test eax, eax
je 0x140066bdb
add ebp, ebx
add rdi, rbx
cmp ebp, r14d
jl 0x140066b87
lea r12d, [r12 + r15 - 0x20]
xor r8d, r8d
mov rcx, rsi
mov edx, r12d
call fcn.1400aa484
add r13d, ebx
cmp r13d, 0x80
jb 0x140066b59
xor bl, bl
mov rcx, rsi
call fcn.1400aa5c0
mov al, bl
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret