joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015030
Capabilities:
Query or enumerate registry key

Disassembly:
push rdi
sub rsp, 0x4b0
mov rax, qword [0x1401dd3a0]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
lea rax, [rsp + 0x68]
lea rdx, str.SYSTEMCurrentControlSet_servicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
xor edi, edi
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140015085
or eax, 0xffffffff
jmp 0x1400151fd
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r11d, dword [rsp + 0x60]
test r11d, r11d
je 0x1400151f0
mov qword [rsp + 0x4c0], rbx
mov ebx, edi
test r11d, r11d
je 0x1400151e8
nop word [rax + rax]
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x80], di
call fcn.1400e5f10
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x80]
mov edx, ebx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x78], 0x103
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea rcx, [rsp + 0x292]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x290], di
call fcn.1400e5f10
lea r11, [rsp + 0x80]
lea r9, str.SYSTEMCurrentControlSet_servicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
lea r8, str._s_s
lea rcx, [rsp + 0x290]
mov edx, 0x103
mov qword [rsp + 0x20], r11
call fcn.1400df954
lea r11, [rsp + 0x70]
lea rdx, [rsp + 0x290]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400151dc
mov rcx, qword [rsp + 0x70]
call fcn.140014f70
test al, al
je 0x1400151d1
mov rcx, qword [rsp + 0x70]
call fcn.140014ea0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
cmp ebx, dword [rsp + 0x60]
jb 0x1400150f0
mov rbx, qword [rsp + 0x4c0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400dd780
add rsp, 0x4b0
pop rdi
ret
Function at 0x140028cc0
Capabilities:
Delete directory
Move file

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov r12, rcx
cmp qword [rcx + 0x20], 8
jb 0x140028cf4
lea rbp, [rcx + 8]
mov rcx, qword [rbp]
jmp 0x140028cfb
lea rbp, [rcx + 8]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140028ef2
lea rcx, str.swifdiag.log
call fcn.140001910
mov rbx, rax
test rax, rax
je 0x140028ed7
mov r10, qword [rax]
lea rsi, str.removeDirectoryNowOrOnReboot
mov qword [rsp + 0x20], rsi
lea rdi, str....._src_swic_srcSwiUpdateShadow.cpp
mov r9, rdi
lea r8, str.default
mov edx, 2
mov rcx, rax
call qword [r10 + 8]
test al, al
je 0x140028ed7
mov byte [rbx + 0xf8], 0x69
xor eax, eax
mov r8b, 0x2e
mov rcx, rdi
mov edx, 1
nop dword [rax]
cmp r8b, 0x5c
cmove eax, edx
inc edx
inc rcx
movzx r8d, byte [rcx]
test r8b, r8b
jne 0x140028d70
add rax, rdi
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], 0x9d
mov qword [rbx + 0x110], rsi
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.140037790
mov r13, rax
mov rcx, rbx
call fcn.1400027f0
mov rdi, rax
xor ebx, ebx
lea r14, str.Directory__
inc rbx
cmp byte [rbx + r14], 0
jne 0x140028dc4
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], 0
cmp ebx, ecx
jge 0x140028e1c
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x90], al
sub ecx, ebx
mov esi, ecx
nop word [rax + rax]
mov r8d, 1
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.14002f090
sub rsi, 1
jne 0x140028e00
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call fcn.14002f090
cmp qword [r13 + 0x20], 0x10
jb 0x140028e37
mov rdx, qword [r13 + 8]
jmp 0x140028e3b
lea rdx, [r13 + 8]
xor r8d, r8d
cmp byte [rdx], r8b
je 0x140028e4d
inc r8
cmp byte [rdx + r8], 0
jne 0x140028e43
mov rcx, rdi
call fcn.1400138f0
xor ebx, ebx
lea r13, str.__scheduled_for_removal_on_next_reboot
nop
inc rbx
cmp byte [rbx + r13], 0
jne 0x140028e60
mov ecx, dword [rdi + 0x430]
mov dword [rdi + 0x430], 0
cmp ebx, ecx
jge 0x140028eac
movzx eax, byte [rdi + 0x42c]
mov byte [rsp + 0x90], al
sub ecx, ebx
mov esi, ecx
mov r8d, 1
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.14002f090
sub rsi, 1
jne 0x140028e90
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.14002f090
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + 8]
nop
cmp qword [rsp + 0x58], 0x10
jb 0x140028ed7
mov rcx, qword [rsp + 0x40]
call fcn.1400ddb14
cmp qword [r12 + 0x20], 8
jb 0x140028ee3
mov rbp, qword [rbp]
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400293b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1401dd3a0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rdx
lea r8, [0x1401a2d14]
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140013df0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400222a0
nop
cmp qword [rsp + 0x40], 8
jb 0x14002940c
mov rcx, qword [rsp + 0x28]
call fcn.1400ddb14
mov qword [rsp + 0x40], 7
xor eax, eax
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], ax
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002946a
and eax, 0x10
test al, al
jne 0x14002946a
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140021910
nop
cmp qword [rsp + 0x70], 8
jb 0x140029463
mov rcx, qword [rsp + 0x58]
call fcn.1400ddb14
mov eax, 1
jmp 0x14002947e
cmp qword [rsp + 0x70], 8
jb 0x14002947c
mov rcx, qword [rsp + 0x58]
call fcn.1400ddb14
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400dd780
add rsp, 0x80
pop rbx
ret
Function at 0x14002ed30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002ed46
mov eax, dword [rcx + 0x38]
jmp 0x14002ed48
xor eax, eax
cmp dword [rbx + 0x10], eax
je 0x14002edbe
mov qword [rsp + 0x58], rdi
mov edi, dword [rbx + 0x18]
mov dword [rbx + 0x10], eax
test rcx, rcx
je 0x14002edae
cmp qword [rcx + 0x30], 0
je 0x14002edae
mov rdx, qword [rbx + 8]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x48], 4
mov rcx, qword [rcx + 0x30]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002edae
mov edi, dword [rsp + 0x40]
mov dword [rbx + 0x14], edi
mov eax, edi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret
mov eax, dword [rbx + 0x14]
add rsp, 0x30
pop rbx
ret

Function at 0x14002fc00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x1401dd3a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov rdi, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor r10d, r10d
cmp eax, 0x104
jae 0x14002fc8a
mov r9d, eax
mov rdx, r10
movsxd r8, eax
lea rcx, [r9 + 1]
cmp rcx, 0x104
jae 0x14002fc80
lea r8, [rsp + r8*2 + 0x20]
nop word [rax + rax]
movzx eax, word [rbx + rdx*2]
test ax, ax
je 0x14002fc80
inc rcx
mov word [r8], ax
inc rdx
add r8, 2
cmp rcx, 0x104
jb 0x14002fc60
lea rax, [r9 + rdx]
mov word [rsp + rax*2 + 0x20], r10w
mov rbx, r10
cmp word [rsp + 0x20], bx
je 0x14002fcb0
cmp rbx, 0x103
jae 0x14002fcaa
inc rbx
cmp word [rsp + rbx*2 + 0x20], r10w
jne 0x14002fc94
jmp 0x14002fcb0
mov word [rsp + rbx*2 + 0x20], r10w
inc rbx
lea rcx, [rbx + rbx]
call fcn.1400ddc18
mov r11, rax
mov qword [rdi], rax
test rax, rax
je 0x14002fcf4
test rbx, rbx
je 0x14002fcf4
lea rcx, [rsp + 0x20]
sub rcx, rax
nop word [rax + rax]
movzx eax, word [rcx + r11]
add r11, 2
sub rbx, 1
mov word [r11 - 2], ax
jne 0x14002fce0
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400dd780
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x140031cb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
call fcn.140031c00
cmp rax, 0xffffffffffffffff
je 0x140031d72
lea r9, [rsp + 0x58]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x140031d5a
cmp dword [rbx + 0x20], eax
jbe 0x140031d30
cmp qword [rbx + 0x28], 0
jbe 0x140031d30
mov rcx, qword [rbx + 0x10]
mov r9d, eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140031d30
mov eax, eax
cmp rax, qword [rbx + 0x28]
jbe 0x140031d30
mov edx, dword [rbx + 0x20]
mov rcx, qword [rbx + 8]
call fcn.140032200
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140031d48
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0xffffffffffffffff
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140031d72
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x140032200
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push rbx
push r12
push r14
sub rsp, 0x450
mov rax, qword [0x1401dd3a0]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r12d, edx
xor r14d, r14d
mov rdx, rcx
mov rbx, r14
cmp r12d, 1
je 0x1400324ae
mov eax, 0x63
cmp r12d, eax
cmova r12d, eax
lea rax, [rsp + 0x20]
sub rdx, rax
nop dword [rax]
cmp rbx, 0x100
ja 0x1400324ae
lea rax, [rsp + rbx*2 + 0x20]
inc rbx
movzx ecx, word [rdx + rax]
mov word [rsp + rbx*2 + 0x22e], cx
mov word [rax], cx
test cx, cx
jne 0x140032250
mov qword [rsp + 0x470], rbp
mov qword [rsp + 0x478], rsi
mov qword [rsp + 0x480], rdi
mov qword [rsp + 0x488], r13
mov edi, r14d
mov r13d, 0x2e
test r12d, r12d
je 0x140032346
lea rbp, [rsp + rbx*2 + 0x1e]
mov esi, 1
nop word [rax + rax]
mov word [rbp], r13w
mov ecx, 1
cmp esi, 9
jbe 0x1400322f9
mov eax, 0xcccccccd
mul esi
mov eax, 0xcccccccd
mov ecx, edx
shr ecx, 3
mul ecx
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
add cx, 0x30
mov word [rbp + 2], cx
mov ecx, 2
mov eax, 0xcccccccd
mul esi
shr edx, 3
movzx eax, dx
shl ax, 2
add dx, ax
movzx eax, si
add dx, dx
sub ax, dx
add ax, 0x30
mov word [rbp + rcx*2], ax
mov word [rbp + rcx*2 + 2], r14w
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400324cb
inc edi
inc esi
cmp edi, r12d
jb 0x1400322c0
lea rbp, [rsp + rbx*2 + 0x1e]
mov edx, edi
mov rcx, rbp
call fcn.140032180
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp edi, 1
jbe 0x14003246f
lea r12, [rsp + rbx*2 + 0x22e]
lea esi, [rdi - 1]
nop word [rax + rax]
mov word [rbp], r13w
mov ecx, 1
cmp edi, 9
jbe 0x1400323b9
mov eax, 0xcccccccd
mul edi
mov eax, 0xcccccccd
mov ecx, edx
shr ecx, 3
mul ecx
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
add cx, 0x30
mov word [rbp + 2], cx
mov ecx, 2
mov eax, 0xcccccccd
mov word [r12], r13w
mul edi
shr edx, 3
movzx eax, dx
shl ax, 2
add dx, ax
movzx eax, di
add dx, dx
sub ax, dx
add ax, 0x30
mov word [rbp + rcx*2], ax
mov word [rbp + rcx*2 + 2], r14w
mov ecx, 1
cmp esi, 9
jbe 0x140032420
mov eax, 0xcccccccd
mul esi
mov eax, 0xcccccccd
mov ecx, edx
shr ecx, 3
mul ecx
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
add cx, 0x30
mov word [r12 + 2], cx
mov ecx, 2
mov eax, 0xcccccccd
xor r8d, r8d
mul esi
shr edx, 3
movzx eax, dx
shl ax, 2
add dx, ax
movzx eax, si
add dx, dx
sub ax, dx
lea rdx, [rsp + 0x20]
add ax, 0x30
mov word [r12 + rcx*2], ax
mov word [r12 + rcx*2 + 2], r14w
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
dec edi
dec esi
cmp edi, 1
ja 0x140032380
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x230]
xor r8d, r8d
mov word [rsp + rbx*2 + 0x22e], r14w
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov r13, qword [rsp + 0x488]
mov rdi, qword [rsp + 0x480]
mov rsi, qword [rsp + 0x478]
mov rbp, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400dd780
add rsp, 0x450
pop r14
pop r12
pop rbx
ret
cmp edi, r12d
jae 0x140032346
inc edi
jmp 0x140032360
Function at 0x140033f20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x460
mov rax, qword [0x1401dd3a0]
xor rax, rsp
mov qword [rsp + 0x440], rax
cmp qword [rcx], 0
mov r12, r8
mov rdi, rdx
mov rbx, rcx
je 0x14003415e
mov rcx, qword [r8]
test rcx, rcx
je 0x140033f66
call fcn.1400ddb14
mov qword [r12], 0
mov qword [r12 + 8], 0
mov qword [r12 + 0x10], 0
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x400
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14003415e
mov qword [rsp + 0x498], rbp
mov qword [rsp + 0x450], r13
mov r13d, dword [rsp + 0x30]
xor edi, edi
mov rbp, r13
test r13d, r13d
je 0x14003408e
mov qword [rsp + 0x458], rsi
nop
mov esi, 0
mov r11, r13
lea rbx, [rsp + rdi + 0x40]
sub r11, rdi
mov rax, rsi
mov r10, rax
mov r9, rax
je 0x140034086
nop
movzx edx, byte [rax + rbx]
lea r8, [rax + rbx]
cmp dl, 0x2c
je 0x14003401a
cmp dl, 0x3b
je 0x14003401a
test dl, dl
je 0x14003401a
xor cl, cl
jmp 0x14003401c
mov cl, 1
test r10, r10
jne 0x140034032
cmp dl, 0x20
je 0x14003403d
test cl, cl
jne 0x14003403d
mov r9, rax
mov r10, r8
jmp 0x140034036
test cl, cl
jne 0x140034054
cmp dl, 0x20
cmovne r9, rax
inc rax
cmp rax, r11
jb 0x140034000
test r10, r10
je 0x140034086
sub r9, r10
lea rax, [r9 + rbx + 1]
jmp 0x140034060
sub r9, r10
lea rsi, [rax + 1]
lea rax, [r9 + rbx + 1]
test r10, r10
je 0x140034075
cmp rax, 0xff
ja 0x140034075
inc rax
add qword [r12 + 8], rax
test rsi, rsi
je 0x140034086
add rdi, rsi
cmp rdi, r13
jb 0x140033fe0
mov rsi, qword [rsp + 0x458]
xor ebx, ebx
test r13d, r13d
je 0x14003414e
nop dword [rax]
sub rbp, rbx
mov edi, 0
lea r11, [rsp + rbx + 0x40]
mov rdx, rdi
mov r9, rdx
mov rax, rdx
je 0x14003414e
nop dword [rax]
movzx ecx, byte [rax + r11]
lea r10, [rax + r11]
cmp cl, 0x2c
je 0x1400340dc
cmp cl, 0x3b
je 0x1400340dc
test cl, cl
je 0x1400340dc
xor r8b, r8b
jmp 0x1400340df
mov r8b, 1
test r9, r9
jne 0x1400340f6
cmp cl, 0x20
je 0x140034102
test r8b, r8b
jne 0x140034102
mov rdx, rax
mov r9, r10
jmp 0x1400340fb
test r8b, r8b
jne 0x140034119
cmp cl, 0x20
cmovne rdx, rax
inc rax
cmp rax, rbp
jb 0x1400340c0
test r9, r9
je 0x14003414e
sub rdx, r9
lea r8, [rdx + r11 + 1]
jmp 0x140034125
sub rdx, r9
lea rdi, [rax + 1]
lea r8, [rdx + r11 + 1]
test r9, r9
je 0x14003413a
mov rdx, r9
mov rcx, r12
call fcn.140033cd0
mov r13d, dword [rsp + 0x30]
test rdi, rdi
je 0x14003414e
add rbx, rdi
mov ebp, r13d
cmp rbx, rbp
jb 0x1400340a0
mov rbp, qword [rsp + 0x498]
mov r13, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400dd780
add rsp, 0x460
pop r12
pop rdi
pop rbx
ret
Function at 0x140036820
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0xc0
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1401dd3a0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rsp + 0x48], r12d
mov rcx, rdx
call fcn.140036700
test al, al
jne 0x140036886
mov qword [rbx + 0x20], 0xf
mov qword [rbx + 0x18], r12
mov byte [rbx + 8], r12b
mov rax, rbx
jmp 0x140036a58
mov dword [rsp + 0x44], r12d
cmp qword [rsi + 0x20], 8
jb 0x14003689b
lea rdi, [rsi + 8]
mov rcx, qword [rdi]
jmp 0x1400368a2
lea rdi, [rsi + 8]
mov rcx, rdi
lea rdx, [rsp + 0x44]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
jne 0x1400368ca
mov qword [rbx + 0x20], 0xf
mov qword [rbx + 0x18], r12
mov byte [rbx + 8], r12b
mov rax, rbx
jmp 0x140036a58
mov ecx, 8
call fcn.1400ddc18
test rax, rax
je 0x1400368e3
lea rcx, [rsp + 0x50]
mov qword [rax], rcx
jmp 0x1400368e6
mov rax, r12
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x40], 0
mov rdx, rbp
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140037270
nop
mov rax, qword [rsp + 0x70]
mov r9, qword [rsp + 0x68]
cmp rax, r9
jne 0x14003691c
call fcn.1400deebc
mov r9, qword [rsp + 0x68]
cmp qword [rsi + 0x20], 8
jb 0x140036926
mov rdi, qword [rdi]
mov r8d, ebp
mov edx, dword [rsp + 0x44]
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x140036978
mov qword [rbx + 0x20], 0xf
mov qword [rbx + 0x18], r12
mov byte [rbx + 8], al
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140036957
call fcn.1400ddb14
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov rcx, qword [rsp + 0x50]
call fcn.1400ddb14
mov rax, rbx
jmp 0x140036a58
mov qword [rsp + 0x80], r12
mov dword [rsp + 0x48], r12d
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
cmp rax, rcx
jne 0x14003699e
call fcn.1400deebc
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x80]
lea rdx, [0x1401a2d14]
call sub.VERSION.dll_VerQueryValueW
mov rdi, qword [rsp + 0x80]
movzx eax, word [rdi + 0xc]
movzx ecx, word [rdi + 0xe]
movzx edx, word [rdi + 8]
movzx r9d, word [rdi + 0xa]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea r8, str._d._d._d._d
mov edx, 0x20
lea rcx, [rsp + 0x90]
call fcn.1400373d0
mov qword [rbx + 0x20], 0xf
mov qword [rbx + 0x18], r12
mov byte [rbx + 8], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x90]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.1400128b0
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140036a3c
call fcn.1400ddb14
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov rcx, qword [rsp + 0x50]
call fcn.1400ddb14
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400dd780
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140036a80
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x100
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1401dd3a0]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov rbx, rdx
mov rdi, rcx
mov qword [r11 - 0x18], 7
xor esi, esi
mov qword [r11 - 0x20], rsi
mov word [r11 - 0x30], si
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [r11 - 0x38]
call fcn.1400012a0
nop
lea r9d, [rsi + 2]
or r8, 0xffffffffffffffff
lea rdx, [0x1401a3a18]
lea rcx, [rsp + 0xd0]
call fcn.140022110
cmp rax, 0xffffffffffffffff
je 0x140036b4c
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xd0]
call fcn.1400220d0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.1400012a0
nop
cmp qword [rsp + 0xc8], 8
jb 0x140036b4c
mov rcx, qword [rsp + 0xb0]
call fcn.1400ddb14
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x34]
call fcn.1400e5f10
mov dword [rsp + 0x30], WSACleanup
mov dword [rsp + 0x34], 0x440
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
cmp qword [rdi + 0x20], 8
jb 0x140036b88
mov rax, qword [rdi + 8]
mov qword [rsp + 0x48], rax
jmp 0x140036b91
lea rax, [rdi + 8]
mov qword [rsp + 0x48], rax
cmp qword [rbx + 0x20], 8
jb 0x140036ba3
mov rax, qword [rbx + 8]
mov qword [rsp + 0x50], rax
jmp 0x140036bac
lea rax, [rbx + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xd8]
cmp qword [rsp + 0xf0], 8
cmovae rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140036c02
cmp qword [rsp + 0xf0], 8
jb 0x140036bfb
mov rcx, qword [rsp + 0xd8]
call fcn.1400ddb14
xor al, al
jmp 0x140036c8b
or edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140036c62
nop word [rax + rax]
cmp dword [rsp + 0x20], 0x103
jne 0x140036c62
or edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140036c30
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0xf0], 8
jb 0x140036c89
mov rcx, qword [rsp + 0xd8]
call fcn.1400ddb14
mov al, 1
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1400dd780
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140036ef0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, rcx
cmp qword [rcx + 0x20], 8
jb 0x140036f1c
lea rbx, [rcx + 8]
mov rcx, qword [rbx]
jmp 0x140036f23
lea rbx, [rcx + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140036fa9
mov eax, 0x5c
mov word [rsp + 0x60], ax
lea r9d, [rax - 0x5b]
or r8, 0xffffffffffffffff
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14002b680
cmp rax, 0xffffffffffffffff
jne 0x140036f5a
mov eax, 1
jmp 0x140036fb2
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1400220d0
nop
mov rcx, rax
call fcn.140036ef0
mov esi, eax
cmp qword [rsp + 0x48], 8
jb 0x140036f8a
mov rcx, qword [rsp + 0x30]
call fcn.1400ddb14
test esi, esi
je 0x140036fa5
cmp qword [rdi + 0x20], 8
jb 0x140036f98
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x140036fb2
xor eax, eax
jmp 0x140036fb2
movzx eax, al
shr eax, 4
and eax, 1
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140037970
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400379be
cmp qword [rbx + 8], 0
je 0x1400379b4
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 8]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400379b4
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400379dc
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x28]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]