joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x51], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov ebx, edx
mov rdi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400589be
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, str.RegQueryValueExW
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.RegCloseKey
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test r14, r14
je 0x1400589be
test rsi, rsi
je 0x1400589be
test rax, rax
je 0x1400589be
mov dword [rbp - 0x19], 0x65004b
mov dword [rbp - 0x15], 0x620079
mov dword [rbp - 0x11], 0x61006f
mov dword [rbp - 0xd], 0x640072
mov dword [rbp - 9], 0x4c0020
mov dword [rbp - 5], 0x790061
mov dword [rbp - 1], 0x75006f
mov dword [rbp + 3], 0x5c0074
mov dword [rbp + 7], 0x750053
mov dword [rbp + 0xb], 0x730062
mov dword [rbp + 0xf], 0x690074
mov dword [rbp + 0x13], 0x750074
mov dword [rbp + 0x17], 0x650074
mov dword [rbp + 0x1b], 0x73
xor eax, eax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x49], rax
mov edx, 0x20019
lea rcx, [rbp - 0x59]
call fcn.14006f600
mov rcx, rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x19]
call r14
test eax, eax
je 0x1400589b5
lea rcx, [rbp - 0x39]
call fcn.140002670
nop
mov r8d, ebx
lea rdx, str._08x
lea rcx, [rbp - 0x39]
call fcn.140064620
xor eax, eax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x2f], eax
mov dword [rbp - 0x41], 0x14
lea rcx, [rbp - 0x39]
call fcn.1400030b0
mov rdx, rax
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x49]
call rsi
test eax, eax
jne 0x1400589a4
xor edx, edx
lea r8d, [rax + 0x10]
lea rcx, [rbp + 0x1f]
call fcn.14017f018
mov ebx, eax
mov rcx, qword [rbp - 0x49]
call rdi
nop
lea rcx, [rbp - 0x39]
call fcn.140002550
nop
lea rcx, [rbp - 0x59]
call fcn.14006f740
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140158860
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400589f0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], 0x114
mov r8d, 0x110
lea rcx, [rsp + 0x24]
call fcn.140177d50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140058a53
cmp dword [rsp + 0x24], 6
jb 0x140058a53
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140158860
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140158860
add rsp, 0x158
ret
Function at 0x140059319
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test rdx, rdx
je 0x1400594a5
push rbp
push rsi
push rdi
push r14
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rcx, qword [rcx]
mov rsi, r9
mov r14, r8
mov rdi, rdx
test rcx, rcx
je 0x14005948a
lea rdx, str.RegQueryValueExW
mov qword [rsp + 0x280], rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140059482
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.140177d50
mov rcx, r14
mov dword [rsp + 0x30], 0x208
call fcn.1400030b0
mov rdx, rax
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call rbx
lea rcx, [rsp + 0x60]
call fcn.140002910
lea rcx, [rsi + 0x50]
mov r8, rax
lea rdx, [rsp + 0x60]
call fcn.140002710
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x28], rax
lea rdx, str.Profile
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
call rbx
lea rcx, [rsp + 0x60]
call fcn.140002910
lea rcx, [rsi + 0x70]
mov r8, rax
lea rdx, [rsp + 0x60]
call fcn.140002710
xor eax, eax
mov dword [rsp + 0x38], 0x65004b
mov word [rsp + 0x54], ax
lea rdx, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x3c], 0x620079
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov dword [rsp + 0x40], 0x61006f
mov dword [rsp + 0x44], 0x640072
mov dword [rsp + 0x48], 0x61004c
mov dword [rsp + 0x4c], 0x6f0079
mov dword [rsp + 0x50], 0x740075
mov dword [rsp + 0x30], 4
call rbx
mov rbx, qword [rsp + 0x280]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140158860
add rsp, 0x288
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005a8d0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x170
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor esi, esi
mov qword [rsp + 0x30], rsi
lea ecx, [rsi + 1]
call fcn.140158884
mov qword [rsp + 0x30], rax
mov byte [rax], sil
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x44]
call fcn.140177d50
mov dword [rsp + 0x40], 0x11c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14005a950
cmp dword [rsp + 0x44], 6
setae cl
mov rax, qword [rsp + 0x30]
mov byte [rax], cl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.14007a900
test al, al
je 0x14005a97b
lea rcx, [rsp + 0x30]
call fcn.14007a1f0
test al, al
jne 0x14005a97b
xor bl, bl
jmp 0x14005aa69
lea rdx, [rbx + 8]
xor ecx, ecx
call fcn.140067110
test al, al
jne 0x14005a9b3
lea rcx, [rbx + 8]
call fcn.140002690
mov word [rsp + 0x20], si
mov qword [rax + 0x10], rsi
cmp qword [rax + 0x18], 8
jb 0x14005a9a6
mov rax, qword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.1400028d0
lea rdx, [rbx + 0x28]
mov ecx, 0x1a
call fcn.140067110
test al, al
jne 0x14005a9ee
lea rcx, [rbx + 0x28]
call fcn.140002690
mov word [rsp + 0x20], si
mov qword [rax + 0x10], rsi
cmp qword [rax + 0x18], 8
jb 0x14005a9e1
mov rax, qword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.1400028d0
lea rdx, [rbx + 0x48]
mov ecx, 2
call fcn.140067110
test al, al
jne 0x14005aa29
lea rcx, [rbx + 0x48]
call fcn.140002690
mov word [rsp + 0x20], si
mov qword [rax + 0x10], rsi
cmp qword [rax + 0x18], 8
jb 0x14005aa1c
mov rax, qword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.1400028d0
lea rdx, [rbx + 0x68]
mov ecx, 0xb
call fcn.140067110
test al, al
jne 0x14005aa64
lea rcx, [rbx + 0x68]
call fcn.140002690
mov word [rsp + 0x20], si
mov qword [rax + 0x10], rsi
cmp qword [rax + 0x18], 8
jb 0x14005aa57
mov rax, qword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.1400028d0
mov byte [rbx], 1
mov bl, 1
lea rcx, [rsp + 0x30]
call fcn.140079b10
movzx eax, bl
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140158860
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14005ab60
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov rdi, rdx
mov qword [r11 - 0x58], rdx
xor r15d, r15d
mov dword [r11 - 0x68], r15d
mov rcx, r8
call fcn.140002690
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x14005abaf
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14005abd0
mov rax, rdx
nop dword [rax + rax]
cmp word [rax], 0x25
je 0x14005ac08
add rax, 2
sub rcx, 1
jne 0x14005abc0
mov rdx, rsi
mov rcx, rdi
call fcn.1400030f0
nop
mov dword [rsp + 0x20], 1
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140158860
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
test rax, rax
je 0x14005abd0
sub rax, rdx
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14005abd0
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1400030f0
nop
mov rcx, rsi
call fcn.1400030b0
mov rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test eax, eax
jne 0x14005ac62
mov rdx, rsi
mov rcx, rdi
call fcn.1400030f0
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x38]
call fcn.140002550
jmp 0x14005abe4
lea ecx, [rax + 2]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140158e14
mov r14, rax
mov rcx, rsi
call fcn.1400030b0
mov rcx, rax
lea r8d, [rbp + 1]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14005acc2
cmp eax, ebp
ja 0x14005acc2
mov eax, eax
mov word [r14 + rax*2], r15w
mov rcx, r14
call fcn.140002910
mov r8, rax
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140002710
mov rcx, r14
call fcn.1401588c0
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140004af0
jmp 0x14005ac4e
Function at 0x14005b910
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x238]
sub rsp, 0x330
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rbx, rdx
mov dword [rbp - 0x40], 0x61004d
mov dword [rbp - 0x3c], 0x720063
mov dword [rbp - 0x38], 0x6d006f
mov dword [rbp - 0x34], 0x640065
mov dword [rbp - 0x30], 0x46005c
mov dword [rbp - 0x2c], 0x61006c
mov dword [rbp - 0x28], 0x680073
mov dword [rbp - 0x24], 0x46005c
mov dword [rbp - 0x20], 0x61006c
mov dword [rbp - 0x1c], 0x680073
mov dword [rbp - 0x18], 0x650048
mov dword [rbp - 0x14], 0x70006c
mov dword [rbp - 0x10], 0x720065
mov dword [rbp - 0xc], 0x650053
mov dword [rbp - 8], 0x760072
mov dword [rbp - 4], 0x630069
mov dword [rbp], 0x2e0065
mov dword [rbp + 4], 0x780065
mov dword [rbp + 8], 0x65
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x10]
call fcn.140177d50
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x29]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x58]
call fcn.140002630
nop
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140002630
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x68]
call fcn.140066e90
nop
lea rcx, [rsp + 0x38]
call fcn.140002550
nop
lea rcx, [rsp + 0x58]
call fcn.140002550
lea rcx, [rbp - 0x68]
call fcn.1400665c0
test al, al
jne 0x14005ba54
xor bl, bl
jmp 0x14005bab4
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.1400796f0
nop
lea rcx, [rsp + 0x78]
call fcn.1400030a0
test al, al
je 0x14005ba75
xor bl, bl
jmp 0x14005baa9
lea rcx, [rsp + 0x78]
call fcn.140002690
cmp rbx, rax
je 0x14005baa7
lea rcx, [rsp + 0x78]
call fcn.140002690
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x14005ba9b
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, rbx
call fcn.140002710
mov bl, 1
lea rcx, [rsp + 0x78]
call fcn.140002550
nop
lea rcx, [rbp - 0x68]
call fcn.140002550
movzx eax, bl
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140158860
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140065390
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x110
call fcn.140177d50
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140065417
cmp dword [rsp + 0x44], 6
jb 0x140065417
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str.Progid
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
call fcn.140065240
test al, al
je 0x140065417
cmp word [rbx], 0
jne 0x140065481
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call fcn.140065240
test al, al
je 0x14006544c
cmp word [rbx], 0
jne 0x140065481
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClasses.html
mov rcx, 0xffffffff80000001
call fcn.140065240
test al, al
je 0x140065485
cmp word [rbx], 0
je 0x140065485
mov al, 1
jmp 0x140065487
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140158860
add rsp, 0x170
pop rbx
ret
Function at 0x140065aa0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27b0]
mov eax, 0x28b0
call fcn.1401592c0
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x28e8], rbx
mov qword [rsp + 0x28f0], rsi
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rbp + 0x27a0], rax
mov rbx, rcx
xor r12d, r12d
mov esi, r12d
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x7a0]
call fcn.140177d50
mov eax, 0x22
mov word [rbp + 0x7a0], ax
test rbx, rbx
je 0x140065d0f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jl 0x140065d0f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xffa
jge 0x140065d0f
mov rdx, rbx
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x1401d469c]
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.Shell32.dll
lea rcx, [rsp + 0x30]
call fcn.140002630
nop
call fcn.140070510
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.1400705b0
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.140002550
test rbx, rbx
je 0x140065d0f
lea rdx, str.ShellExecuteW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x140065d0f
lea rcx, [rsp + 0x60]
call fcn.1400654a0
mov ebx, r12d
lea rdi, [rsp + 0x60]
nop dword [rax]
cmp word [rdi], 0
je 0x140065c0e
movsxd r14, ebx
imul rax, r14, 0x210
lea r8, [rsp + 0x60]
add r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x7a0]
lea rdx, str.open
xor ecx, ecx
call r15
cmp rax, 0x20
ja 0x140065c1e
inc ebx
add rdi, 0x210
cmp ebx, 3
jge 0x140065c41
jmp 0x140065bd0
imul rax, r14, 0x210
mov esi, dword [rbp + rax + 0x16c]
cmp dword [rbp + rax + 0x168], 0
jne 0x140065c39
add esi, 0x10
test esi, esi
jne 0x140065d0b
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x7a0]
lea rdx, str.open
xor ecx, ecx
call r15
cmp rax, 0x20
ja 0x140065d06
lea rax, str._programfiles_x86__Internet_Exploreriexplore.exe
mov qword [rsp + 0x30], rax
lea rax, str._programfiles_Internet_Exploreriexplore.exe
mov qword [rsp + 0x38], rax
mov rbx, r12
nop dword [rax]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x590]
call fcn.140177d50
mov r8d, 0x103
lea rdx, [rbp + 0x590]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140065cfb
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x7a0]
lea r8, [rbp + 0x590]
lea rdx, str.open
xor ecx, ecx
call r15
cmp rax, 0x20
ja 0x140065d06
inc rbx
cmp rbx, 2
jae 0x140065d0b
jmp 0x140065c90
mov esi, 0x10
mov eax, esi
jmp 0x140065d11
xor eax, eax
mov rcx, qword [rbp + 0x27a0]
xor rcx, rsp
call fcn.140158860
lea r11, [rsp + 0x28b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140065dc0
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
lea rcx, [r11 - 0x48]
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140158860
add rsp, 0x68
ret

Function at 0x140065e20
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
add rcx, 4
mov r8d, 0x118
call fcn.140177d50
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140065f82
cmp dword [rbx + 4], 6
mov qword [rsp + 0x188], rdi
ja 0x140065e84
jne 0x140065f25
cmp dword [rbx + 8], 2
jb 0x140065f25
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x140065f25
mov edx, 1
mov rcx, rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140065f25
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140065f25
movups xmm0, xmmword [0x1401d6158]
mov rcx, rax
movups xmm1, xmmword [0x1401d6168]
movups xmmword [rsp + 0x140], xmm0
movups xmmword [rsp + 0x150], xmm1
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x140065f25
lea rcx, [rax + 6]
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140065f25
cmp word [rdi + 2], ax
jbe 0x140065f25
movzx edx, word [rdi + 0x32]
movzx eax, word [rdi + 0x30]
movzx ecx, word [rdi + 0x36]
mov dword [rbx + 4], edx
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], ecx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140065f76
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call fcn.140177d50
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call rdi
test eax, eax
jne 0x140065f76
mov eax, dword [rsp + 0x2c]
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x188]
mov al, 1
jmp 0x140065f84
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140158860
add rsp, 0x170
pop rbx
ret
Function at 0x140066850
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
call fcn.1400030a0
test al, al
je 0x140066893
xor al, al
jmp 0x140066a55
mov rcx, rsi
call fcn.1400666d0
test al, al
je 0x1400668a6
mov al, 1
jmp 0x140066a55
mov rcx, rsi
call fcn.1400030b0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400668f5
lea rcx, [rbp - 0x48]
call fcn.140002670
nop
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.14007cbe0
test al, al
je 0x1400668ec
lea rcx, [rbp - 0x48]
call fcn.1400030b0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rbp - 0x48]
call fcn.140002550
mov rcx, rsi
call fcn.1400666d0
test al, al
jne 0x14006689f
mov rcx, rsi
call fcn.140003280
mov r14, rax
xor ebx, ebx
test rax, rax
je 0x1400669f2
mov rcx, rsi
call fcn.140002690
mov rdi, rax
lea r12d, [rbx + 0x2f]
lea r15d, [rbx + 0x5c]
nop word [rax + rax]
mov rcx, rdi
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140066940
mov rcx, qword [rdi]
cmp r12w, word [rcx + rbx*2]
je 0x14006695e
mov rax, rdi
cmp rdx, 8
jb 0x140066953
mov rax, qword [rdi]
cmp r15w, word [rax + rbx*2]
jne 0x1400669e6
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.14000b1f0
nop
lea rcx, [rbp - 0x48]
call fcn.1400030a0
test al, al
jne 0x1400669dd
lea rcx, [rbp - 0x48]
call fcn.1400664b0
test al, al
jne 0x1400669dd
lea rcx, [rbp - 0x48]
call fcn.1400030b0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400669dd
lea rcx, [rbp - 0x28]
call fcn.140002670
nop
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x48]
call fcn.14007cbe0
test al, al
je 0x1400669d3
lea rcx, [rbp - 0x28]
call fcn.1400030b0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rbp - 0x28]
call fcn.140002550
nop
lea rcx, [rbp - 0x48]
call fcn.140002550
inc rbx
cmp rbx, r14
jb 0x140066930
mov rcx, rsi
call fcn.1400664b0
test al, al
jne 0x140066a4d
mov rcx, rsi
call fcn.1400030b0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140066a4d
lea rcx, [rbp - 0x28]
call fcn.140002670
nop
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.14007cbe0
test al, al
je 0x140066a44
lea rcx, [rbp - 0x28]
call fcn.1400030b0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rbp - 0x28]
call fcn.140002550
mov rcx, rsi
call fcn.1400666d0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140158860
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140067110
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x140222080]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rdx
mov r14d, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], rdx
mov rcx, rdx
call fcn.140002690
xor esi, esi
mov word [rsp + 0x22], si
mov qword [rax + 0x10], rsi
cmp qword [rax + 0x18], 8
jb 0x14006715e
mov rax, qword [rax]
lea rdx, [rsp + 0x22]
mov rcx, rax
call fcn.1400028d0
mov rdx, rdi
mov ecx, r14d
call fcn.140067250
movzx ebx, al
mov byte [rsp + 0x20], al
jmp 0x140067191
test bl, bl
jne 0x140067224
cmp r14d, 0x1a
jne 0x140067224
mov rcx, rdi
call fcn.140002690
mov word [rsp + 0x22], si
mov qword [rax + 0x10], rsi
cmp qword [rax + 0x18], 8
jb 0x1400671be
mov rax, qword [rax]
lea rdx, [rsp + 0x22]
mov rcx, rax
call fcn.1400028d0
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x40]
call fcn.140177d50
mov r8d, 0x207
lea rdx, [rsp + 0x40]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x40]
call fcn.140002910
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140002710
mov rcx, rdi
call fcn.1400030a0
movzx ebx, bl
mov ecx, 1
test al, al
cmove ebx, ecx
movzx eax, bl
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140158860
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r14
pop rdi
pop rsi
ret