joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006d30
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe0
mov dword [rsp + 0x50], 0
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [rsp + 0xac], 0x101
xor eax, eax
mov word [rsp + 0xb0], ax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x140006df0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006df4
xor eax, eax
jmp 0x140006df9
mov eax, 1
add rsp, 0xe0
pop rdi
ret

Function at 0x140007100
Capabilities:
Get token privileges

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa60
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov edx, 2
mov rcx, qword [rsp + 0xa70]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [rsp + 0x30], 0
jne 0x140007153
xor eax, eax
jmp 0x14000726b
mov eax, dword [rsp + 0x30]
mov edx, 1
mov ecx, eax
call qword [sym.imp.msvcrt.dll_calloc]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov edx, 3
mov rcx, qword [rsp + 0xa70]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea rcx, str._nwhoami__priv_n
call fcn.140002fc0
mov dword [rsp + 0x34], 0
jmp 0x1400071b0
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x34], eax
jae 0x140007266
lfence
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0x104
movsxd rax, dword [rsp + 0x34]
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 4]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
mov dword [rsp + 0x44], eax
lea rdx, [rsp + 0x50]
lea rcx, str.__50ws
call fcn.140002fc0
lea rax, [rsp + 0x260]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
movsxd rax, dword [rsp + 0x34]
imul rax, rax, 0xc
lea rdx, [rsp + 0x260]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + rax + 0xc]
call fcn.140007540
lea rdx, [rsp + 0x260]
lea rcx, str._ws_n
call fcn.140002fc0
jmp 0x1400071a6
mov eax, 1
add rsp, 0xa60
pop rdi
ret
Function at 0x140007e60
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x98
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x54]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea rax, [rsp + 0x70]
lea rcx, str._C:WindowsSystem32calc.exe_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1f
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWARE_testtcb
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140007efc
mov edx, dword [rsp + 0x50]
lea rcx, str.____Failed_opening_key___d
call fcn.140002fc0
jmp 0x140007f89
lea rax, [rsp + 0x70]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
inc qword [rsp + 0x58]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
cmp byte [rax + rcx], 0
jne 0x140007f0f
mov rax, qword [rsp + 0x58]
inc rax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Debugger
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140007f72
mov edx, dword [rsp + 0x50]
lea rcx, str.____Failed_writing_key___d
call fcn.140002fc0
jmp 0x140007f89
lea rcx, str.___Key_set
call fcn.140002fc0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x140008300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x140008420
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x140008465
movzx edi, word [rsi + 0x5c]
test bl, bl
je 0x140008568
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
jmp 0x140008568
mov eax, dword [rsi + 0x58]
cmp eax, 1
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.1400a44e8
cmp eax, 0xffffffff
je 0x140008564
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x140008475
cmp byte [rsi + 0x5f], 0
je 0x1400084b5
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test bl, bl
je 0x140008526
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x140008568
lea r13, [rsp + 0x56]
lea r12, [rsp + 0x48]
lea r14, [rsp + 0x58]
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r15, qword [rdx]
lea r9, [rsp + rdi]
add r9, 0x58
mov rax, qword [rcx]
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r8, r14
call qword [rax + 0x18]
cmp eax, 1
jne 0x140008551
mov rax, qword [rsi + 0x50]
mov qword [rax], r15
cmp edi, 8
je 0x140008564
mov rcx, qword [rsi + 0x40]
call fcn.1400a44e8
cmp eax, 0xffffffff
je 0x140008564
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1400084c4
mov edi, edi
test edi, edi
jle 0x14000854a
mov rdx, qword [rsi + 0x40]
lea eax, [rdi - 1]
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.1400a5e54
dec rdi
cmp eax, 0xffffffff
jne 0x140008528
jmp 0x140008564
movzx edi, word [rsp + 0x56]
jmp 0x140008568
cmp eax, 2
je 0x140008564
cmp eax, 3
je 0x140008499
jmp 0x1400084a3
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008db90
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400085d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r14, [rsp + 0x38]
lea r12, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov ebp, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x28]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1400a410c
cmp rax, rbx
jne 0x140008657
cmp edi, 1
je 0x140008604
cmp edi, 2
je 0x140008657
mov rcx, qword [rsi + 0x40]
call fcn.1400a3d08
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008db90
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140008680
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x1400086b5
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400a410c
xor ebx, ebx
test rsi, rsi
jle 0x1400086da
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x1400086da
inc rbx
cmp rsi, rbx
jne 0x1400086bc
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400086f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp edx, 0xffffffff
je 0x14000874e
mov r15d, edx
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x140008759
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.1400a410c
mov esi, 0xffffffff
cmp rax, 1
je 0x140008751
jmp 0x140008809
xor r15d, r15d
mov esi, r15d
jmp 0x140008809
lea rbx, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], rbx
lea rsi, [rsp + 0x57]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140008804
mov ebp, eax
cmp eax, 3
je 0x1400087e3
cmp ebp, 1
ja 0x140008804
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.1400a410c
cmp rax, rsi
jne 0x140008804
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140008776
jmp 0x140008751
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.1400a410c
cmp rax, 1
je 0x140008751
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008db90
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140008870
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x1400088a5
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400a410c
xor ebx, ebx
test rsi, rsi
jle 0x1400088cb
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x1400088cb
inc rbx
cmp rsi, rbx
jne 0x1400088ac
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400088e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dx, 0xffff
je 0x14000893e
mov r15d, edx
mov rdi, rcx
mov word [rsp + 0x56], dx
cmp byte [rcx + 0x58], 0
je 0x140008949
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.1400a410c
mov si, 0xffff
cmp rax, 1
je 0x140008941
jmp 0x1400089f8
xor r15d, r15d
mov esi, r15d
jmp 0x1400089f8
lea rbx, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], rbx
lea rsi, [rsp + 0x56]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x1400089f4
mov ebp, eax
cmp eax, 3
je 0x1400089d3
cmp ebp, 1
ja 0x1400089f4
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.1400a410c
cmp rax, rsi
jne 0x1400089f4
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140008966
jmp 0x140008941
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.1400a410c
cmp rax, 1
je 0x140008941
mov si, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008db90
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140008bc0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140008bf7
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x140008bd1
ret

Function at 0x140008d30
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140008d68
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x140008d41
ret
Function at 0x14002ae80
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1400e7ce0]
test rdi, rdi
jne 0x14002af40
mov ecx, 0x48
call fcn.14008d7cc
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.14008d7cc
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x1400e7ce0], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14002af62
cmp word [rax], 0
je 0x14002af62
xor edx, edx
nop word cs:[rax + rax]
lea rcx, [rdx + 1]
cmp word [rax + rdx*2 + 2], 0
mov rdx, rcx
jne 0x14002af20
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rcx
mov rcx, rsi
call fcn.14002af70
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008db90
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
xor ecx, ecx
jmp 0x14002af2f
Function at 0x14002af70
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 3
call fcn.14003e220
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x14002b0f0
movups xmm0, xmmword [rbx]
movups xmmword [r14], xmm0
mov dword [rsp + 0x3c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r15, rax
test rax, rax
je 0x14002b117
lea rdx, [0x1400bdb2e]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002b12a
mov rsi, rax
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3c]
call rax
mov r13, rax
movsxd rdi, dword [rsp + 0x3c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x30], 0
test rdi, rdi
je 0x14002b08a
test edi, edi
js 0x14002b132
shl rdi, 3
lea r12, [rdi + rdi*2]
mov rcx, r12
call fcn.14008d7cc
mov rsi, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
add rax, r12
mov qword [rsp + 0x30], rax
xor ebx, ebx
mov rdx, qword [r13 + rbx]
mov rcx, rsi
call fcn.140024700
add rsi, 0x18
add rbx, 8
cmp rdi, rbx
jne 0x14002b06b
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.14002ac60
movups xmmword [r14], xmm6
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r15, r15
je 0x14002b0b2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x20]
test rsi, rsi
je 0x14002b0f0
mov rax, qword [rsp + 0x28]
cmp rax, rsi
je 0x14002b112
lea rdi, [rax - 0x18]
cmp byte [rax - 1], 0
jns 0x14002b0d9
mov rcx, qword [rax - 0x18]
call fcn.14008d81c
mov rax, rdi
cmp rsi, rdi
jne 0x14002b0c6
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x28], rsi
call fcn.14008d81c
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008db90
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
jmp 0x14002b0e6
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x14002b01e
xor r13d, r13d
jmp 0x14002b021
lea rcx, [rsp + 0x20]
call fcn.1400299b0
int3
Function at 0x140034b90
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov r15, rdx
mov r14, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
lea rdx, str.CreateFileVersionInfoWin
lea r8, str..._.._base_file_version_info_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r9d, 0x4d
call fcn.14004af20
lea rcx, [rsp + 0x48]
mov rdx, rsi
xor r8d, r8d
call fcn.14004af50
cmp byte [r15 + 0x17], 0
jns 0x140034bf2
mov r15, qword [r15]
lea rdx, [rsp + 0x24]
mov rcx, r15
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x140034d4b
mov edi, eax
mov esi, eax
mov rcx, rsi
call fcn.14008d7cc
mov rbp, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.140090f50
lea rax, [rsi - 1]
mov rcx, rsi
mov rdx, rbp
and rcx, 7
je 0x140034c46
neg rcx
xor ebx, ebx
dec rbx
cmp rcx, rbx
jne 0x140034c38
mov rdx, rbp
sub rdx, rbx
cmp rax, 7
jb 0x140034c66
mov rax, rsi
sub rax, rdx
add rax, rbp
nop word cs:[rax + rax]
nop
add rax, 0xfffffffffffffff8
jne 0x140034c60
mov edx, dword [rsp + 0x24]
mov rcx, r15
mov r8d, edi
mov r9, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140034d54
lea r8, [rsp + 0x28]
mov qword [r8], 0
lea rdx, str.VarFileInfoTranslation
lea r9, [rsp + 0x9c]
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140034d54
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x140034d54
mov rdi, rbp
add rdi, rsi
mov ecx, 0x38
call fcn.14008d7cc
mov rsi, rax
mov eax, dword [rbx]
lea rcx, [0x1400bdfd0]
mov qword [rsi], rcx
mov qword [rsi + 8], rbp
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
mov qword [rsi + 0x20], rbp
mov dword [rsi + 0x28], eax
lea r8, [rsp + 0x28]
mov qword [r8], 0
lea rdx, [0x1400be1f2]
lea r9, [rsp + 0x9c]
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140034d65
mov rax, qword [rsp + 0x28]
mov qword [rsi + 0x30], rax
mov qword [r14], rsi
lea rcx, [rsp + 0x48]
call fcn.14004b070
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14008db90
mov rax, r14
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [r14], 0
jmp 0x140034d1e
mov qword [r14], 0
mov rcx, rbp
call fcn.14008d81c
jmp 0x140034d1e
int3
Function at 0x140034f50
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov r15, r8
mov r13, rdx
mov rdi, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx esi, word [rcx + 0x28]
movzx r14d, word [rcx + 0x2a]
mov r12, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r12
mov ebp, eax
movzx ebx, word [rdi + 0x2a]
movzx eax, word [rdi + 0x28]
mov dword [rsp + 0x40], eax
call r12
mov r12d, eax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], esi
lea r9, str.StringFileInfo_04x_04x_ls
lea rsi, [rsp + 0x50]
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140035190
lea r8, [rsp + 0x48]
mov qword [r8], 0
mov rcx, qword [rdi + 0x20]
lea r9, [rsp + 0x44]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14003503b
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14003503b
mov r8d, dword [rsp + 0x44]
test r8d, r8d
je 0x14003503b
dec r8d
mov rcx, r15
call fcn.1400284f0
mov sil, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14008db90
mov eax, esi
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx eax, bp
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
lea r9, str.StringFileInfo_04x_04x_ls
lea rsi, [rsp + 0x50]
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140035190
lea r8, [rsp + 0x48]
mov qword [r8], 0
mov rcx, qword [rdi + 0x20]
lea r9, [rsp + 0x44]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400350a3
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400350a3
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140035007
mov qword [rsp + 0x30], r13
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
lea rsi, [rsp + 0x50]
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140035190
lea r8, [rsp + 0x48]
mov qword [r8], 0
mov rcx, qword [rdi + 0x20]
lea r9, [rsp + 0x44]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140035110
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140035110
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140035007
movzx eax, r12w
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
lea rsi, [rsp + 0x50]
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140035190
lea r8, [rsp + 0x48]
mov qword [r8], 0
mov rcx, qword [rdi + 0x20]
lea r9, [rsp + 0x44]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14003517d
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14003517d
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140035007
xor esi, esi
jmp 0x140035015
Function at 0x1400357c0
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
lea rdx, [0x1400be22d]
lea r8, str..._.._base_files_file_util_win.cc
lea rbp, [rsp + 0x290]
mov rcx, rbp
mov r9d, 0x196
call fcn.14004af20
lea rcx, [rsp + 0x30]
mov rdx, rbp
xor r8d, r8d
call fcn.14004af50
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x140035826
mov rdx, qword [rbx]
lea rbp, [rsp + 0x290]
mov r8d, 0x104
mov rcx, rbp
call fcn.14003eb10
mov rcx, rbp
call fcn.1400030a0
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x140035850
mov rdx, qword [rdi]
lea rbp, [rsp + 0x80]
mov r8d, 0x104
mov rcx, rbp
call fcn.14003eb10
mov rcx, rbp
call fcn.1400030a0
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14003587a
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x140035886
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x1400358ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004b540
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x1400358b9
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x1400358c2
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
test rsi, rsi
je 0x1400358f2
test eax, eax
jne 0x1400358f2
cmp ebp, 0xfffffffc
jne 0x1400358e9
call fcn.14004b4d0
mov ebp, eax
mov dword [rsi], ebp
xor edi, edi
jmp 0x1400358f2
mov dil, 1
lea rcx, [rsp + 0x30]
call fcn.14004b070
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.14008db90
mov eax, edi
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140035920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x1400e45d8]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rdx, str.PathExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r9d, 0x1c9
call fcn.14004af20
lea rdi, [rsp + 0x48]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14004af50
cmp byte [rsi + 0x17], 0
jns 0x14003597c
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rdi
call fcn.14004b070
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14008db90
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret