joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400082d0
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rdx
mov rsi, rcx
mov rcx, qword [rcx]
xor r14d, r14d
test rcx, rcx
je 0x140008314
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], r14
mov word [rsi + 8], r14w
mov qword [rsp + 0x48], r14
mov ecx, 0x58
call fcn.140025ae4
mov rbx, rax
mov qword [rsp + 0x48], rax
mov qword [rax], r14
mov qword [rax + 8], r14
mov dword [rax + 0x10], 0x18
lea rdi, [rax + 0x28]
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], r14d
lea rdx, str.Advapi32.dll
lea rcx, [rsp + 0x28]
call fcn.140002c74
nop
call fcn.1400161a0
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.140016270
mov qword [rbx + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.140002b70
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140015e00
mov rbx, qword [rsp + 0x48]
mov qword [rbx], rax
cmp qword [rbx], 0
lea r9, [rbx + 0x10]
jne 0x1400083a4
mov r9, r14
mov rcx, rbp
call fcn.140002a60
test al, al
jne 0x1400083b7
call fcn.140002a6c
jmp 0x1400083ba
mov rax, r14
mov r8, rax
xor edx, edx
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi], rax
test rax, rax
je 0x1400083e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400083e1
mov byte [rsi + 9], 1
cmp qword [rsi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x140008408
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000841b
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], r14
mov edx, 0x58
mov rcx, rbx
call fcn.140025dd4
mov qword [rsp + 0x48], r14
movzx eax, sil
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140025ac0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000b920
Capabilities:
Set file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebp, r9d
mov rsi, r8
mov r14, rdx
mov r15d, dword [rsp + 0xc8]
mov dword [rsp + 0x20], r15d
mov r12d, dword [rsp + 0xc0]
mov r9d, r12d
mov r8d, ebp
mov rdx, rsi
mov rcx, r14
call fcn.140013e50
movzx ebx, al
test al, al
jne 0x14000ba65
test ebp, 0x50000000
je 0x14000ba0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000ba0e
mov rcx, rsi
call fcn.140002a6c
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14000b9f1
lea rcx, [rsp + 0x38]
call fcn.140002d0c
nop
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140015900
test al, al
je 0x14000b9e7
lea rcx, [rsp + 0x38]
call fcn.140002a6c
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop
lea rcx, [rsp + 0x38]
call fcn.140002b70
mov dword [rsp + 0x20], r15d
mov r9d, r12d
mov r8d, ebp
mov rdx, rsi
mov rcx, r14
call fcn.140013e50
movzx ebx, al
test al, al
jne 0x14000ba65
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xffffffe0
cmp eax, 1
ja 0x14000ba65
xor ebx, ebx
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], r15d
mov r9d, r12d
mov r8d, ebp
mov rdx, rsi
mov rcx, r14
call fcn.140013e50
movzx edi, al
test al, al
jne 0x14000ba5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xffffffe0
cmp eax, 1
ja 0x14000ba5f
inc rbx
cmp rbx, 0x28
jb 0x14000ba20
movzx eax, dil
jmp 0x14000ba68
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140025ac0
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000fdc0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.140025ae4
mov qword [rbx], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov byte [rax], 0
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x14000fe27
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140025ac0
add rsp, 0x150
pop rbx
ret
Function at 0x140011dd0
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
add rcx, 4
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140011f32
cmp dword [rbx + 4], 6
mov qword [rsp + 0x188], rdi
ja 0x140011e34
jne 0x140011ed5
cmp dword [rbx + 8], 2
jb 0x140011ed5
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x140011ed5
mov edx, 1
mov rcx, rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140011ed5
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140011ed5
movups xmm0, xmmword [0x14003e8b0]
mov rcx, rax
movups xmm1, xmmword [0x14003e8c0]
movups xmmword [rsp + 0x140], xmm0
movups xmmword [rsp + 0x150], xmm1
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x140011ed5
lea rcx, [rax + 6]
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140011ed5
cmp word [rdi + 2], ax
jbe 0x140011ed5
movzx edx, word [rdi + 0x32]
movzx eax, word [rdi + 0x30]
movzx ecx, word [rdi + 0x36]
mov dword [rbx + 4], edx
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], ecx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140011f26
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call rdi
test eax, eax
jne 0x140011f26
mov eax, dword [rsp + 0x2c]
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x188]
mov al, 1
jmp 0x140011f34
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140025ac0
add rsp, 0x170
pop rbx
ret
Function at 0x1400141f0
Capabilities:
Get common file path

Disassembly:
push r14
sub rsp, 0x270
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x20c
call sub.VCRUNTIME140.dll_memset
mov edx, 0x105
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x140014477
mov qword [rsp + 0x288], rbx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x290], rbp
mov qword [rsp + 0x298], rsi
mov qword [rsp + 0x268], rdi
mov qword [rsp + 0x260], r15
xor r15d, r15d
mov word [rsp + 0x24a], r15w
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, r14
mov rsi, rax
call fcn.140002de0
mov rdi, rax
mov rbp, qword [rax + 0x18]
cmp rsi, rbp
ja 0x1400142cb
mov rbx, rax
cmp rbp, 8
jb 0x14001429e
mov rbx, qword [rax]
mov r8, rsi
mov qword [rax + 0x10], rsi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002fe4
lea rcx, [rbx + rsi*2]
mov word [rsp + 0x20], r15w
lea rdx, [rsp + 0x20]
call fcn.140002fdc
jmp 0x140014433
call fcn.140002f24
cmp rsi, rax
ja 0x14001447b
call fcn.140002f24
mov rcx, rsi
mov rbx, rax
or rcx, 7
mov qword [rsp + 0x38], rcx
cmp rcx, rax
ja 0x14001432a
mov rcx, r14
call fcn.140002de0
mov rdx, qword [rax + 0x18]
mov rax, rbx
mov rcx, rdx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
ja 0x14001432a
lea rax, [rcx + rdx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x38]
call fcn.140002e7c
mov rbx, qword [rax]
lea rax, [rbx + 1]
movabs rcx, 0x7fffffffffffffff
lea rdx, [rax + rax]
mov r8, 0xffffffffffffffff
cmp rax, rcx
jbe 0x14001434d
mov rdx, r8
jmp 0x140014356
cmp rdx, 0x1000
jb 0x140014380
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.140025ae4
mov rcx, rax
test rax, rax
je 0x140014409
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140014392
test rdx, rdx
je 0x14001438f
mov rcx, rdx
call fcn.140025ae4
jmp 0x140014392
mov rax, r15
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
mov qword [rdi + 0x10], rsi
mov r8, rsi
mov qword [rdi + 0x18], rbx
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
call fcn.140002e8c
lea rcx, [rbx + rsi*2]
mov word [rsp + 0x20], r15w
lea rdx, [rsp + 0x20]
call fcn.140002fdc
cmp rbp, 8
jb 0x140014410
mov rcx, qword [rdi]
lea rdx, [rbp*2 + 2]
cmp rdx, 0x1000
jb 0x1400143fa
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140014409
mov rcx, r8
call fcn.140025dd4
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
jmp 0x140014433
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rsp + 0x28]
call fcn.140002de0
mov rcx, rdi
mov r8, rax
call fcn.140002de0
mov rdx, rax
call fcn.1400029a0
mov rcx, qword [r8]
mov qword [rax], rcx
mov rdi, qword [rsp + 0x268]
mov al, 1
mov rsi, qword [rsp + 0x298]
mov rbp, qword [rsp + 0x290]
mov rbx, qword [rsp + 0x288]
mov r15, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140025ac0
add rsp, 0x270
pop r14
ret
xor al, al
jmp 0x14001445d
call fcn.140003280
int3
Function at 0x140014490
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebx, edx
mov rdi, rcx
and ebx, 0xffffb1af
call fcn.140002a6c
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400144d6
mov al, 1
jmp 0x14001451e
lea rcx, [rsp + 0x28]
call fcn.140002d0c
nop
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140015900
test al, al
je 0x14001450f
lea rcx, [rsp + 0x28]
call fcn.140002a6c
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14001450f
mov bl, 1
jmp 0x140014511
xor bl, bl
lea rcx, [rsp + 0x28]
call fcn.140002b70
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140025ac0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140014540
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
call fcn.140002a6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400145b8
lea rcx, [rsp + 0x28]
call fcn.140002d0c
nop
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140015900
test al, al
je 0x1400145ac
lea rcx, [rsp + 0x28]
call fcn.140002a6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x28]
call fcn.140002b70
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140025ac0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1400145d0
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov rbx, rcx
mov rcx, rdx
call fcn.140002a6c
mov rdx, rax
mov rcx, rbx
call fcn.140002a6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1400146a3
xor sil, sil
lea rcx, [rsp + 0x48]
call fcn.140002d0c
nop
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140015900
movzx ebx, sil
mov ecx, 1
test al, al
cmovne ebx, ecx
lea rcx, [rsp + 0x28]
call fcn.140002d0c
nop
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140015900
test al, al
jne 0x14001466a
test bl, bl
je 0x1400146a7
lea rcx, [rsp + 0x28]
call fcn.140002a6c
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002a6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1400146a7
lea rcx, [rsp + 0x28]
call fcn.140002b70
nop
lea rcx, [rsp + 0x48]
call fcn.140002b70
mov al, 1
jmp 0x1400146be
lea rcx, [rsp + 0x28]
call fcn.140002b70
nop
lea rcx, [rsp + 0x48]
call fcn.140002b70
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140025ac0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400146e0
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140002a6c
mov rdx, rax
mov rcx, rsi
call fcn.140002a6c
mov rcx, rax
mov r8d, 0xb
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140014740
mov al, 1
jmp 0x140014843
xor dil, dil
lea rcx, [rsp + 0x68]
call fcn.140002d0c
nop
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.140015900
movzx edi, dil
mov ecx, 1
test al, al
cmovne edi, ecx
lea rcx, [rsp + 0x48]
call fcn.140002d0c
nop
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140015900
test al, al
jne 0x14001478a
test dil, dil
je 0x1400147b4
lea rcx, [rsp + 0x48]
call fcn.140002a6c
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140002a6c
mov rcx, rax
mov r8d, 0xb
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140014812
mov rcx, rbx
call fcn.140014540
cmp eax, 0xffffffff
je 0x140014829
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140002d24
nop
lea rcx, [rsp + 0x28]
call fcn.140015340
test al, al
je 0x14001481f
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400145d0
test al, al
je 0x14001481f
mov rdx, rbx
mov rcx, rsi
call fcn.1400145d0
lea rcx, [rsp + 0x28]
test al, al
je 0x140014816
call fcn.140014870
nop
lea rcx, [rsp + 0x28]
call fcn.140002b70
mov bl, 1
jmp 0x14001482b
mov rdx, rbx
call fcn.1400145d0
nop
lea rcx, [rsp + 0x28]
call fcn.140002b70
xor bl, bl
lea rcx, [rsp + 0x48]
call fcn.140002b70
nop
lea rcx, [rsp + 0x68]
call fcn.140002b70
movzx eax, bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140025ac0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140014870
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
call fcn.140002a6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400148b9
mov al, 1
jmp 0x140014a47
mov rcx, rdi
call fcn.140002a6c
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140002c74
nop
lea rcx, [rbp - 0x28]
call fcn.140002a6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x140014920
lea rcx, [rbp - 0x48]
call fcn.140002d0c
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.140015900
test al, al
je 0x140014916
lea rcx, [rbp - 0x48]
call fcn.140002a6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
lea rcx, [rbp - 0x48]
call fcn.140002b70
nop
lea rcx, [rbp - 0x28]
call fcn.140002b70
cmp esi, 0xffffffff
jne 0x140014935
xor al, al
jmp 0x140014a47
mov rcx, rdi
call fcn.140002a6c
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140002c74
nop
lea rcx, [rbp - 0x28]
call fcn.140002a6c
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140014966
xor bl, bl
jmp 0x1400149b1
lea rcx, [rbp - 0x48]
call fcn.140002d0c
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.140015900
test al, al
je 0x1400149a6
lea rcx, [rbp - 0x48]
call fcn.140002a6c
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400149a6
lea rcx, [rbp - 0x48]
call fcn.140002b70
xor bl, bl
jmp 0x1400149b1
lea rcx, [rbp - 0x48]
call fcn.140002b70
mov bl, 1
lea rcx, [rbp - 0x28]
call fcn.140002b70
test bl, bl
jne 0x14001492e
mov rcx, rdi
call fcn.140002a6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400148b2
lea rcx, [rbp - 0x28]
call fcn.140002d0c
nop
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.140015900
test al, al
je 0x140014a0f
lea rcx, [rbp - 0x28]
call fcn.140002a6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140014a0f
mov bl, 1
jmp 0x140014a3b
mov rcx, rdi
call fcn.140002a6c
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140002c74
nop
mov edx, esi
lea rcx, [rbp - 0x48]
call fcn.140014490
nop
lea rcx, [rbp - 0x48]
call fcn.140002b70
xor bl, bl
lea rcx, [rbp - 0x28]
call fcn.140002b70
movzx eax, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140025ac0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400150b0
Capabilities:
Get common file path

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x20c
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.140002a6c
mov rcx, rdi
mov rdx, rax
call fcn.140002a6c
mov rcx, rax
lea r9, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140015331
mov qword [rsp + 0x2a8], rbp
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x268], rsi
mov qword [rsp + 0x260], r15
xor r15d, r15d
mov word [rsp + 0x24a], r15w
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, r14
mov rsi, rax
call fcn.140002de0
mov rdi, rax
mov rbp, qword [rax + 0x18]
cmp rsi, rbp
ja 0x140015193
mov rbx, rax
cmp rbp, 8
jb 0x140015166
mov rbx, qword [rax]
mov r8, rsi
mov qword [rax + 0x10], rsi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002fe4
lea rcx, [rbx + rsi*2]
mov word [rsp + 0x20], r15w
lea rdx, [rsp + 0x20]
call fcn.140002fdc
jmp 0x1400152fb
call fcn.140002f24
cmp rsi, rax
ja 0x140015335
call fcn.140002f24
mov rcx, rsi
mov rbx, rax
or rcx, 7
mov qword [rsp + 0x38], rcx
cmp rcx, rax
ja 0x1400151f2
mov rcx, r14
call fcn.140002de0
mov rdx, qword [rax + 0x18]
mov rax, rbx
mov rcx, rdx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
ja 0x1400151f2
lea rax, [rcx + rdx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x38]
call fcn.140002e7c
mov rbx, qword [rax]
lea rax, [rbx + 1]
movabs rcx, 0x7fffffffffffffff
lea rdx, [rax + rax]
mov r8, 0xffffffffffffffff
cmp rax, rcx
jbe 0x140015215
mov rdx, r8
jmp 0x14001521e
cmp rdx, 0x1000
jb 0x140015248
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.140025ae4
mov rcx, rax
test rax, rax
je 0x1400152d1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001525a
test rdx, rdx
je 0x140015257
mov rcx, rdx
call fcn.140025ae4
jmp 0x14001525a
mov rax, r15
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
mov qword [rdi + 0x10], rsi
mov r8, rsi
mov qword [rdi + 0x18], rbx
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
call fcn.140002e8c
lea rcx, [rbx + rsi*2]
mov word [rsp + 0x20], r15w
lea rdx, [rsp + 0x20]
call fcn.140002fdc
cmp rbp, 8
jb 0x1400152d8
mov rcx, qword [rdi]
lea rdx, [rbp*2 + 2]
cmp rdx, 0x1000
jb 0x1400152c2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400152d1
mov rcx, r8
call fcn.140025dd4
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
jmp 0x1400152fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rsp + 0x28]
call fcn.140002de0
mov rcx, rdi
mov r8, rax
call fcn.140002de0
mov rdx, rax
call fcn.1400029a0
mov rcx, qword [r8]
mov qword [rax], rcx
mov rsi, qword [rsp + 0x268]
mov al, 1
mov rbp, qword [rsp + 0x2a8]
mov r15, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140025ac0
add rsp, 0x270
pop r14
pop rdi
pop rbx
ret
xor al, al
jmp 0x140015315
call fcn.140003280
int3
Function at 0x140016fe0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, pe_nt_image_headers64
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140017067
cmp dword [rsp + 0x44], 6
jb 0x140017067
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str.Progid
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
call fcn.140016e90
test al, al
je 0x140017067
cmp word [rbx], 0
jne 0x1400170d1
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call fcn.140016e90
test al, al
je 0x14001709c
cmp word [rbx], 0
jne 0x1400170d1
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClasses.html
mov rcx, 0xffffffff80000001
call fcn.140016e90
test al, al
je 0x1400170d5
cmp word [rbx], 0
je 0x1400170d5
mov al, 1
jmp 0x1400170d7
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140025ac0
add rsp, 0x170
pop rbx
ret