joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800e7dec
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800e7e0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800dddd4
or eax, 0xffffffff
jmp 0x1800e7e0e
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800e93b8
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1800e9395
call fcn.1800dde44
mov dword [rax], 0x16
call fcn.1800debf0
or eax, 0xffffffff
jmp 0x1800e93b2
sub dword [rcx + 0x10], 1
jns 0x1800e93a4
add rsp, 0x28
jmp 0x1800f3df8
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1800e9374
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x1800f3e2a
call fcn.1800dde44
mov dword [rax], 0x16
call fcn.1800debf0
jmp 0x1800f3f47
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1800f3f47
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1800f3f47
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1800f3e59
lock or dword [rcx + 0x14], 0x10
jmp 0x1800f3f47
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1800f3e6d
call fcn.1800f6c4c
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.1800e7a7c
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.1800f5ce8
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1800f3f35
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x1800f3f00
mov rcx, rdi
call fcn.1800e7a7c
cmp eax, esi
je 0x1800f3eeb
mov rcx, rdi
call fcn.1800e7a7c
cmp eax, 0xfffffffe
je 0x1800f3eeb
mov rcx, rdi
call fcn.1800e7a7c
movsxd rbx, eax
lea r14, [0x18012f5c0]
mov rcx, rdi
sar rbx, 6
call fcn.1800e7a7c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1800f3ef2
lea rdx, [0x18012a460]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1800f3f00
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x1800f3f24
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x1800f3f24
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x1800f3f24
mov dword [rdi + 0x20], 0x1000
add dword [rdi + 0x10], esi
mov rax, qword [rdi]
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x1800f3f4a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14088c810
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14088c997
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14088c841
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14088c827
add dl, dl
jne 0x14088c84e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14088c8ae
xor eax, eax
add dl, dl
jne 0x14088c85d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14088c965
add dl, dl
jne 0x14088c86e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14088c87b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14088c888
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14088c895
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14088c8a2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14088c836
mov eax, 1
add dl, dl
jne 0x14088c8be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14088c8cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14088c8b3
sub eax, ebx
mov ebx, 1
jne 0x14088c904
mov ecx, 1
add dl, dl
jne 0x14088c8e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14088c8f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14088c8db
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14088c836
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14088c920
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14088c92d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14088c915
cmp eax, 0x7d00
jae 0x14088c953
cmp eax, 0x500
jb 0x14088c94e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14088c836
cmp eax, 0x7f
ja 0x14088c956
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14088c836
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14088c98a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14088c836
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020630]
call fcn.1400123b8
lea rcx, [0x140021200]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
mov cl, 0x67
xchg dword [rbx - 0x55], ebp
xchg ecx, eax
mov bl, 0x28
pop rsi
xchg ebp, eax
invalid
and byte [rdi + 0x11], al
fnstenv [riz*2 - 0x3293618c]
je 0x14003f617
insb byte [rdi], dx
int 0x5c
je 0x14003f617
insb byte [rdi], dx
int 0x5c
or edi, dword [rcx + 0x224887fc]
xchg dword [rax + 0x22], ecx
mov al, 0x7e
test eax, 0x486813a5
mov dword [rcx], ecx
in eax, 0xf7
invalid
invalid
call rbx
in al, 0x5f
mov ah, 0x54
sub cl, byte [rdx + 0x7e69575e]
pop rsi
push rdi
invalid
jle 0x14003f678
invalid
invalid
imul edi, dword [rsi - 0x33], 0xf63cf0f0
int1
test bl, al
ret
mov ebx, 0x266a3745
std
pop rax
mov bh, 0x43
invalid
invalid
invalid
insd dword [rdi], dx
shl edx, 1
add ecx, dword [rcx - 0x3f417ffd]
invalid
push rbx
invalid
mov esi, 0x40653c0
rcl byte [rbx + 6], 4
js 0x14003f671
mov dh, 0x8d
push rcx
sbb ebp, eax
jmp 0x14003f750
jl 0x14003f69d
invalid
test eax, 0x55d94c9f
in eax, 0x50
jp 0x14003f6d1
jne 0x14003f67f
loope 0x14003f6bb
xchg esp, eax
iretd
push r12
sbb ecx, 0xbb73ea88
xchg byte [rax], ch
mov cl, 0x99
and edx, dword [rsi]
sal byte [rbx + 0x2e8242db], 1
invalid

Function at 0x14000727c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x140007342
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007306
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007303
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140020630]
mov rdx, rsi
call fcn.1400123b8
jmp 0x140007306
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072d3
mov rdx, qword [0x14001f110]
lea rcx, [0x140020630]
mov rdi, rdx
inc rdx
mov qword [0x14001f110], rdx
lea edx, [rbx + 0x20]
call fcn.140012400
lea rcx, [0x140021200]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x1400074d0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
xor r15d, r15d
mov r13d, r9d
mov r12d, edx
mov ebp, r15d
cmp edx, 1
jl 0x140007634
mov qword [rsp + 0x50], rbx
test rcx, rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r14
lea r14, [0x14001968c]
mov rbx, r14
mov edi, r15d
cmovne rbx, rcx
test r8, r8
cmovne r14, r8
mov rsi, rbx
movzx ecx, word [r14]
test cx, cx
je 0x140007600
cmp word [r14 + 2], di
je 0x140007600
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [r14 + rax*2], di
jne 0x140007540
movsxd r15, eax
nop dword [rax]
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x14000756d
cmp word [rbx], bp
je 0x14000756d
add rbx, 2
jmp 0x140007550
inc edi
cmp edi, r12d
je 0x140007582
cmp word [rbx], bp
je 0x14000758b
lea rbx, [rbx + r15*2]
mov rsi, rbx
jmp 0x140007550
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
xor r15d, r15d
mov rcx, rbx
call fcn.140012da0
mov r14, qword [rsp + 0x20]
mov edi, eax
test eax, eax
je 0x1400075ba
mov ecx, r13d
call fcn.140012e10
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memmove
mov edx, r13d
mov ecx, ebp
call fcn.140012e40
test edi, edi
mov rdi, qword [rsp + 0x60]
mov rbx, rax
jne 0x1400075de
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rsi, qword [rsp + 0x58]
movsxd rcx, ebp
mov word [rbx + rcx*2], r15w
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
movzx eax, word [rbx]
cmp ax, cx
je 0x14000760d
test ax, ax
jne 0x140007620
inc edi
cmp edi, edx
je 0x140007626
test ax, ax
je 0x14000758e
lea rsi, [rbx + 2]
add rbx, 2
jmp 0x140007600
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
jmp 0x14000758e
mov ecx, r9d
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
jmp fcn.140012f20

Function at 0x140008000
Capabilities:
Get thread local storage value

Disassembly:
mov r10, rcx
test rcx, rcx
je 0x140008031
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008010
mov ecx, 1
mov r9d, r8d
sub ecx, edx
add eax, ecx
mov rcx, r10
mov r8d, eax
jmp 0x140008040
mov ecx, r8d
jmp fcn.140012f20
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov ebp, r8d
test r8d, r8d
mov edi, r9d
mov esi, edx
mov rbx, rcx
cmovs ebp, r15d
call fcn.140012da0
mov edx, edi
mov ecx, ebp
mov r14d, eax
call fcn.140012e40
mov rdi, rax
test r14d, r14d
je 0x140008091
mov ecx, r14d
call fcn.140012f60
mov rbx, rax
test rbx, rbx
je 0x1400080d7
cmp esi, 1
jle 0x1400080b1
nop dword [rax + rax]
cmp word [rbx], r15w
je 0x1400080d7
dec esi
add rbx, 2
cmp esi, 1
jg 0x1400080a0
movzx eax, word [rbx]
test ax, ax
je 0x1400080d7
sub rbx, rdi
nop dword [rax]
test ebp, ebp
je 0x1400080d7
mov word [rdi], ax
movzx eax, word [rbx + rdi + 2]
add rdi, 2
dec ebp
test ax, ax
jne 0x1400080c0
mov ecx, ebp
call fcn.140013010
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov word [rdi], r15w
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140008100
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.140012e40
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.140016b9c
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x140008130
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140013010

Function at 0x14000bf34
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x14000bfab
movsxd rdx, ecx
lea rcx, [0x14000be90]
call qword [sym.imp.USER32.DLL_EnumWindows]
mov rbx, qword [0x140020678]
test rbx, rbx
je 0x14000c01e
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14000bfa1
cmp byte [rbx + 0x20], 0
je 0x14000bfa1
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.DLL_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x14000bf67
jmp 0x14000c01e
mov rbx, qword [0x140020678]
test rbx, rbx
je 0x14000c01e
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14000c016
cmp byte [rbx + 0x21], 0
je 0x14000bfda
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x14000c006
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.DLL_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020678]
call fcn.1400123b8
mov rbx, rdi
test rdi, rdi
jne 0x14000bfb7
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14000c178
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x140021260]
call fcn.140011794
xor ebp, ebp
or esi, 0xffffffff
mov r14, rax
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx edx, word [rax]
test dx, dx
je 0x14000c275
mov rcx, qword [rsp + 0x40]
mov r9w, 0x22
cmp dx, 0x20
jne 0x14000c1cf
add rax, 2
cmp word [rax], 0x20
je 0x14000c1c5
movzx edx, word [rax]
mov r8d, 1
cmp dx, r9w
jne 0x14000c20d
add rax, 2
mov rbx, rax
movzx ecx, word [rax]
test cx, cx
je 0x14000c24d
cmp cx, r9w
je 0x14000c1ff
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x14000c1ed
cmp word [rax], bp
je 0x14000c24d
mov rcx, rax
add rax, 2
jmp 0x14000c255
test dx, dx
je 0x14000c252
mov rbx, rax
cmp dx, 0x20
je 0x14000c1ff
add rax, 2
cmp word [rax], r9w
jne 0x14000c243
add rax, 2
movzx ecx, word [rax]
test cx, cx
je 0x14000c24d
cmp cx, r9w
je 0x14000c243
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x14000c231
movzx edx, word [rax]
test dx, dx
jne 0x14000c215
jmp 0x14000c1ff
mov rcx, rax
jmp 0x14000c255
mov r8d, ebp
cmp dword [r14], esi
jne 0x14000c25f
test rdi, rdi
jne 0x14000c27f
test r8d, r8d
je 0x14000c266
inc esi
movzx edx, word [rax]
mov rbx, rbp
test dx, dx
jne 0x14000c1bf
test rdi, rdi
jne 0x14000c294
movsxd rax, esi
jmp 0x14000c296
test rbx, rbx
je 0x14000c294
sub rcx, rbx
mov rax, rbx
sar rcx, 1
mov dword [rdi], ecx
inc dword [r14]
jmp 0x14000c296
mov dword [rdi], ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x14000c2ac
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x140021260]
call fcn.140011794
xor ecx, ecx
add rsp, 0x28
jmp fcn.14000c178

Function at 0x14000c340
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [0x140021260]
xor ebp, ebp
mov esi, edx
mov dword [rax + 8], ebp
call fcn.140011794
test ebx, ebx
js 0x14000c36f
mov dword [rax], ebx
lea rcx, [rsp + 0x30]
call fcn.14000c178
mov edi, dword [rsp + 0x30]
mov edx, esi
mov ecx, edi
mov rbx, rax
call fcn.140012e40
mov ecx, ebp
jmp 0x14000c3ab
test edi, edi
je 0x14000c3b0
movzx edx, word [rbx]
cmp dx, 0x22
jne 0x14000c39e
inc ecx
jmp 0x14000c3a5
mov word [rax], dx
add rax, 2
add rbx, 2
dec edi
cmp word [rbx], bp
jne 0x14000c38d
mov word [rax], bp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.140013010

Function at 0x14000c584
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x28
mov rax, rdx
test rcx, rcx
je 0x14000c5a4
test rax, rax
lea rdx, [0x14001968c]
cmovne rdx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x140004f30
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x14003e050]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x140004f6e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.14000af90
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x140004f94
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x140004fa7
cmp qword [rsi + 0x18], 8
jb 0x140004faa
mov rsi, qword [rsi]
jmp 0x140004faa
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x140004fce
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140004fce
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x140004ff5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140005008
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov edx, 0x58
mov rcx, rbx
call fcn.140018800
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140018280
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008110
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14003e050]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov qword [rdx + 0x10], rsi
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x14000814f
mov rax, qword [rdx]
mov word [rax], si
call fcn.140008220
movzx edi, al
mov byte [rsp + 0x20], al
jmp 0x14000816f
test dil, dil
jne 0x1400081e9
mov qword [rbx + 0x10], rsi
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140008185
mov rax, qword [rbx]
mov word [rax], si
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x30]
call fcn.140019a10
mov r8d, 0x207
lea rdx, [rsp + 0x30]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400081c0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400035d0
movzx edi, dil
mov eax, 1
cmp qword [rbx + 0x10], 0
cmovne edi, eax
movzx eax, dil
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140018280
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rdx, rcx
jmp 0x140008110

Function at 0x1400084d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14003e050]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov qword [rdx + 0x10], rsi
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x14000814f
mov rax, qword [rdx]
mov word [rax], si
call fcn.140008220
movzx edi, al
mov byte [rsp + 0x20], al
jmp 0x14000816f
test dil, dil
jne 0x1400081e9
mov qword [rbx + 0x10], rsi
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140008185
mov rax, qword [rbx]
mov word [rax], si
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x30]
call fcn.140019a10
mov r8d, 0x207
lea rdx, [rsp + 0x30]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400081c0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400035d0
movzx edi, dil
mov eax, 1
cmp qword [rbx + 0x10], 0
cmovne edi, eax
movzx eax, dil
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140018280
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rdx, rcx
jmp 0x140008110

Function at 0x1400084e0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14003e050]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.140018510
mov qword [rbx], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov byte [rax], 0
call fcn.140019a10
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x140008547
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140018280
add rsp, 0x150
pop rbx
ret
Function at 0x14000b5b0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x14003e050]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x110
call fcn.140019a10
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000b637
cmp dword [rsp + 0x44], 6
jb 0x14000b637
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str.Progid
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
call fcn.14000b3e0
test al, al
je 0x14000b637
cmp word [rbx], 0
jne 0x14000b6a1
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call fcn.14000b3e0
test al, al
je 0x14000b66c
cmp word [rbx], 0
jne 0x14000b6a1
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClasses.html
mov rcx, 0xffffffff80000001
call fcn.14000b3e0
test al, al
je 0x14000b6a5
cmp word [rbx], 0
je 0x14000b6a5
mov al, 1
jmp 0x14000b6a7
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140018280
add rsp, 0x170
pop rbx
ret
Function at 0x14000e7e0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14003e050]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, r8
mov rbx, rdx
mov r8, rdx
lea rdx, [rbp - 0x30]
call fcn.14000f390
nop
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
xor r14d, r14d
mov qword [rbp - 0x50], r14
mov word [rbp - 0x48], ax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140004f30
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov byte [rbp - 0x38], r14b
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x14000e868
xor dil, dil
jmp 0x14000e886
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x14000e87f
xor dil, dil
jmp 0x14000e886
mov byte [rbp - 0x48], 1
mov dil, 1
mov byte [rbp - 0x38], dil
mov byte [rbp - 0x60], 0
lea r9, [rbp - 0x60]
mov r8, rsi
mov rdx, rbx
call fcn.14000e970
test al, al
jne 0x14000e8ba
cmp byte [rbp - 0x60], al
je 0x14000e8ba
cmp qword [rbx + 0x18], 8
jb 0x14000e8b0
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
test dil, dil
je 0x14000e8d2
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000e8ce
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x48], 0
mov qword [rbp - 0x40], r14
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000e8e9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x50], r14
mov word [rbp - 0x48], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14000e92b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e926
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e961
call fcn.140018800
movdqa xmm0, xmmword [0x140035bf0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140018280
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14001c254
int3