joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029a2c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d034
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d034
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029b7c
cmp rax, 0xffffffffffffffff
je 0x140029b7c
xor edi, edi
test rbp, rbp
jle 0x140029b27
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f948
mov rbx, rax
test rax, rax
jne 0x140029ab4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029b1d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a99c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001dd10
cmp eax, 0xffffffff
je 0x140029afd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029ac4
mov edx, r15d
mov ecx, r14d
call fcn.14001a99c
jmp 0x140029b1d
cmp byte [rsi + 0x38], dil
je 0x140029b14
cmp dword [rsi + 0x34], 5
jne 0x140029b14
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029b1d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b700
jmp 0x140029b90
jns 0x140029b90
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d034
cmp rax, 0xffffffffffffffff
jne 0x140029b48
cmp byte [rsi + 0x30], dil
je 0x140029b90
mov edi, dword [rsi + 0x2c]
jmp 0x140029b90
mov ecx, r14d
call fcn.140018e54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029b90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029b90
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029b89
mov eax, dword [rsi + 0x2c]
jmp 0x140029b8e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d034
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ac80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002aca8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002aca8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1800010e0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180001108
xor eax, eax
lea r8, section..text
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140001d88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001dd2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001dd2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001dd2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001dd2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001dd2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001dd4
xor al, al
add rsp, 0x28
ret
Function at 0x1400018c0
Capabilities:
Manipulate user privileges

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
test rcx, rcx
jne 0x1400018d6
xor eax, eax
add rsp, 0x50
pop rsi
ret
lea rcx, [rsp + 0x68]
call fcn.140001000
test eax, eax
je 0x1400018ef
mov eax, 1
add rsp, 0x50
pop rsi
ret
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.140001100
test eax, eax
je 0x14000191a
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
mov eax, 2
add rsp, 0x50
pop rsi
ret
mov qword [rsp + 0x40], rbp
mov rbp, qword [rsp + 0x78]
mov rcx, rbp
call fcn.140001080
test rax, rax
je 0x14000194b
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
mov rbp, qword [rsp + 0x40]
mov eax, 3
add rsp, 0x50
pop rsi
ret
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], rdi
lea rdi, str.SeServiceLogonRight
xor eax, eax
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x60]
repne scasw ax, word [rdi]
lea r8, [rsp + 0x70]
mov rdx, rbp
not rcx
mov dword [rsp + 0x60], 0xffffffff
dec rcx
add cx, cx
mov word [rsp + 0x20], cx
add cx, 2
mov word [rsp + 0x22], cx
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
test eax, eax
je 0x1400019f8
mov ecx, eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov edi, eax
cmp eax, 2
je 0x1400019f8
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
mov ecx, edi
call fcn.140006fa0
mov rdi, rax
call fcn.140016bd0
mov r9, rdi
lea rcx, [rax + 0x60]
mov r8, rsi
mov edx, 0x40000209
call fcn.140007220
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov eax, 4
add rsp, 0x50
pop rsi
ret
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x48], rbx
xor ebx, ebx
test ecx, ecx
je 0x140001a48
mov rdi, rbx
nop word [rax + rax]
mov r9, qword [rsp + 0x70]
movzx eax, word [rsp + 0x20]
cmp word [rdi + r9], ax
jne 0x140001a3e
movzx r8d, word [rsp + 0x22]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rdi + r9 + 8]
call fcn.1400173bc
test eax, eax
je 0x140001ab1
mov ecx, dword [rsp + 0x60]
inc ebx
add rdi, 0x10
cmp ebx, ecx
jb 0x140001a10
mov rcx, qword [rsp + 0x70]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x20]
mov r9d, 1
mov rdx, rbp
call sub.ADVAPI32.dll_LsaAddAccountRights
mov rcx, rbp
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
test edi, edi
je 0x140001ad0
mov ecx, edi
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov ecx, eax
call fcn.140006fa0
mov rdi, rax
call fcn.140016bd0
mov r8, rdi
lea rcx, [rax + 0x60]
mov edx, 0x4000020a
call fcn.140007220
mov eax, 5
jmp 0x140001ae8
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x70]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
jmp 0x140001ae6
call fcn.140016bd0
mov r8, rsi
mov edx, 0x40000204
lea rcx, [rax + 0x30]
call fcn.140007220
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x50
pop rsi
ret
Function at 0x140006b90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test eax, eax
jne 0x140006be9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fa0
mov r8, rsi
mov edx, 0xc00003fe
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], 0
movzx ecx, ax
call fcn.140007160
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov rbx, rdi
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140006c45
lea eax, [rbx + 1]
lea r9, str.expand_environment_string
lea r8, str.ExpandEnvironmentStrings__
mov edx, 0xc00003eb
movzx ecx, ax
mov qword [rsp + 0x20], rbx
call fcn.140007160
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140006cac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fa0
mov r8, rsi
mov edx, 0xc00003fe
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], 0
movzx ecx, ax
call fcn.140007160
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140006cc0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r13d, r13d
movzx r12d, dl
mov rsi, rcx
mov edi, r13d
cmp word [rcx], di
je 0x140006db3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
nop
mov rbx, rsi
cmp word [rsi], r13w
je 0x140006d10
nop dword [rax]
cmp word [rbx], 0x3d
je 0x140006d1a
add rbx, 2
cmp word [rbx], r13w
jne 0x140006d00
cmp word [rbx], 0x3d
jne 0x140006d9a
mov word [rbx], r13w
test r12b, r12b
je 0x140006d73
add rbx, 2
mov rcx, rbx
call fcn.140006b90
mov rbp, rax
test rax, rax
je 0x140006d5f
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140006d49
inc edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140006d84
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140006d84
inc edi
jmp 0x140006d84
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140006d84
inc edi
add rbx, 2
cmp word [rbx], r13w
je 0x140006d9a
nop
add rbx, 2
cmp word [rbx], r13w
jne 0x140006d90
cmp word [rbx + 2], r13w
lea rsi, [rbx + 2]
jne 0x140006cf0
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
xor edx, edx
jmp 0x140006cc0
Function at 0x140006de0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r13d, r13d
movzx r12d, dl
mov rsi, rcx
mov edi, r13d
cmp word [rcx], di
je 0x140006db3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
nop
mov rbx, rsi
cmp word [rsi], r13w
je 0x140006d10
nop dword [rax]
cmp word [rbx], 0x3d
je 0x140006d1a
add rbx, 2
cmp word [rbx], r13w
jne 0x140006d00
cmp word [rbx], 0x3d
jne 0x140006d9a
mov word [rbx], r13w
test r12b, r12b
je 0x140006d73
add rbx, 2
mov rcx, rbx
call fcn.140006b90
mov rbp, rax
test rax, rax
je 0x140006d5f
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140006d49
inc edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140006d84
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140006d84
inc edi
jmp 0x140006d84
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140006d84
inc edi
add rbx, 2
cmp word [rbx], r13w
je 0x140006d9a
nop
add rbx, 2
cmp word [rbx], r13w
jne 0x140006d90
cmp word [rbx + 2], r13w
lea rsi, [rbx + 2]
jne 0x140006cf0
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
xor edx, edx
jmp 0x140006cc0

Function at 0x140006df0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rcx, rax
mov rdi, rax
call fcn.140006b50
mov rcx, rax
call fcn.140006de0
mov ebx, eax
test rdi, rdi
je 0x140006e25
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140006e70
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbx
mov eax, 0x100f0
call fcn.140020f60
sub rsp, rax
mov rax, qword [0x140029c30]
xor rax, rsp
mov qword [rsp + 0x100e0], rax
mov rbx, rcx
lea rdx, [rsp + 0xe0]
mov r8d, 0x7fff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.1400174b0
xor eax, eax
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x404
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140006f2a
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
jmp 0x140006f40
call qword [sym.imp.KERNEL32.dll_GetLastError]
or ecx, 0xffffffff
mov edx, 1
cmp eax, 0x57
cmove ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x100e0]
xor rcx, rsp
call fcn.140017480
add rsp, 0x100f0
pop rbx
ret
Function at 0x140006fa0
Capabilities:
Get thread local storage value
Identify system language via api
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, ecx
mov ecx, dword [0x14002ac80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140006ff7
lea ecx, [rax + 0x40]
mov edx, 0xffff
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x140006fe8
lea rax, str._out_of_memory_for_error_message_
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov ecx, dword [0x14002ac80]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov qword [rsp + 0x30], 0
mov r8d, edi
xor edx, edx
mov ecx, 0x1200
movzx r9d, ax
mov dword [rsp + 0x28], 0xffff
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x140007085
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, edi
xor edx, edx
mov ecx, 0x1200
mov dword [rsp + 0x28], 0xffff
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x140007085
lea r9, str.system_error__lu
or r8, 0xffffffffffffffff
mov edx, 0xffff
mov rcx, rbx
mov dword [rsp + 0x20], edi
call fcn.140016e78
test eax, eax
jns 0x140007085
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400070a0
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov qword [rsp + 0x30], 0
movzx r9d, ax
lea rax, [rsp + 0x58]
mov r8d, ebx
xor edx, edx
mov ecx, 0xb00
mov dword [rsp + 0x28], 0xffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x140007155
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, ebx
xor edx, edx
mov ecx, 0xb00
mov dword [rsp + 0x28], 0xffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x140007155
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, str.system_error__lu
or r8, 0xffffffffffffffff
mov edx, 0xffff
mov rcx, rax
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x58], rax
call fcn.140016e78
test eax, eax
jns 0x140007155
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rax, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret
Function at 0x140007160
Capabilities:
Access the windows event log

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0xd8
movzx edi, cx
lea rdx, str.nssm
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140007207
xor r9d, r9d
lea r8, [rsp + 0x100]
add r8, 0xfffffffffffffff8
mov edx, r9d
mov rcx, qword [r8 + 8]
add r8, 8
test rcx, rcx
je 0x1400071c1
cmp edx, 0xf
jge 0x1400071c1
movsxd rax, edx
inc edx
mov qword [rsp + rax*8 + 0x50], rcx
jmp 0x1400071a3
mov qword [rsp + 0x40], r9
movsxd rax, edx
xor r8d, r8d
mov qword [rsp + rax*8 + 0x50], r9
lea rax, [rsp + 0x50]
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r9d
mov word [rsp + 0x28], dx
mov qword [rsp + 0x20], r9
mov r9d, dword [rsp + 0xf8]
movzx edx, di
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
add rsp, 0xd8
pop rdi
pop rbx
ret

Function at 0x1400073b0
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov r8, rbx
mov edx, 5
xor ecx, ecx
movzx r9d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x140007417
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x717
je 0x140007400
xor eax, eax
jmp 0x14000743d
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
lea edx, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1400073fc
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400073fc
mov r9, rsi
mov r8, rbp
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000af70
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140029c30]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x28], r8
mov rdi, r8
or r8, 0xffffffffffffffff
mov rbx, rcx
mov qword [rsp + 0x20], rdx
lea r9, str._s_s
lea edx, [r8 + 0x1e]
lea rcx, [rsp + 0x30]
call fcn.140016e78
test eax, eax
jns 0x14000afe0
xor ecx, ecx
mov ebx, 1
lea r9, str.delete_createfile_parameter__
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov edx, 0xc00003eb
movzx ecx, bx
call fcn.140007160
mov eax, ebx
jmp 0x14000aff7
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140017480
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000b1f0
Capabilities:
Check if file exists
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x100b8
call fcn.140020f60
sub rsp, rax
mov rax, qword [0x140029c30]
xor rax, rsp
mov qword [rsp + 0x100a0], rax
mov r13, rcx
lea rcx, [rsp + 0x50]
mov edi, r9d
mov ebp, r8d
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xor r14d, r14d
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 7]
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
lea r15d, [r14 + 1]
test rax, rax
je 0x14000b336
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x14000b29a
lea rdx, [rsp + 0x74]
lea rcx, [rsp + 0x50]
mov ebx, r14d
mov edi, r14d
mov ebp, r14d
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x14000b2a1
mov ebx, dword [rsp + 0x10120]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x14000b30e
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [rsp + 0x44]
mov r11d, dword [rsp + 0x40]
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x48], r11d
mov ecx, ebp
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
imul rcx, rcx, 0xffffffffff676980
add rax, rcx
mov qword [rsp + 0x48], rax
shr rax, 0x20
mov ecx, dword [rsp + 0x48]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x74]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jg 0x14000b440
test edi, edi
jne 0x14000b316
test ebx, ebx
je 0x14000b38b
mov eax, dword [rsp + 0x80]
cmp eax, ebx
jb 0x14000b440
jne 0x14000b38b
cmp dword [rsp + 0x84], edi
jb 0x14000b440
jmp 0x14000b38b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000b440
mov ecx, eax
call fcn.140006fa0
mov qword [rsp + 0x38], r14
mov r9, rsi
mov qword [rsp + 0x30], rax
lea rax, str.CreateFile__
mov r8, r13
mov edx, 0xc0000427
movzx ecx, r15w
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.140007160
lea rdx, [rsp + 0x74]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x74]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
mov r8d, 0x7fff
mov rcx, rsi
call fcn.14000b0d0
lea rdx, [rsp + 0xa0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14000b3f7
mov ecx, 4
lea rax, [rsp + 0xa0]
mov r9, rsi
mov r8, r13
mov edx, 0x40000435
movzx ecx, cx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.140007160
jmp 0x14000b440
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000b440
mov ecx, eax
call fcn.140006fa0
mov qword [rsp + 0x38], r14
mov r9, rsi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa0]
mov r8, r13
mov qword [rsp + 0x28], rax
lea rax, str.MoveFile__
mov edx, 0xc0000427
movzx ecx, r15w
mov qword [rsp + 0x20], rax
call fcn.140007160
mov rcx, qword [rsp + 0x100a0]
xor rcx, rsp
call fcn.140017480
add rsp, 0x100b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000b4b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x60], rbx
mov r12, r9
mov r13d, r8d
mov qword [rsp + 0x68], rdi
mov r14, rdx
mov rbp, rcx
mov esi, 0x7d0
mov r15d, 1
mov rcx, qword [rbp + 0x20]
mov r9, r12
mov r8d, r13d
mov rdx, r14
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000b592
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x6d
je 0x14000b547
cmp eax, 0x3e3
je 0x14000b542
cmp eax, 0x718
je 0x14000b527
or ebx, 0xffffffff
jmp 0x14000b532
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, r15d
add esi, 0xbb8
cmp esi, 0x4268
jl 0x14000b4e3
jmp 0x14000b54a
mov ebx, r15d
jmp 0x14000b54a
or ebx, 0xffffffff
mov rcx, qword [rbp + 0x40]
cmp dword [rcx], r15d
jne 0x14000b58e
mov rsi, qword [rsp + 0x80]
test byte [rsi], r15b
jne 0x14000b58b
mov ecx, edi
call fcn.140006fa0
mov r9, qword [rbp + 8]
mov r8, qword [rbp]
mov edx, 0xc0000432
movzx ecx, r15w
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.140007160
or dword [rsi], r15d
mov eax, ebx
jmp 0x14000b594
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret

Function at 0x14000b5c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x60], rbx
mov r12, r9
mov r13d, r8d
mov qword [rsp + 0x68], rdi
mov r14, rdx
mov rbp, rcx
mov esi, 0x7d0
mov r15d, 1
mov rcx, qword [rbp + 0x28]
mov r9, r12
mov r8d, r13d
mov rdx, r14
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000b699
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
je 0x14000b699
cmp eax, 0x6d
je 0x14000b657
cmp eax, 0x70
je 0x14000b63c
cmp eax, 0x718
je 0x14000b63c
mov edi, r15d
jmp 0x14000b647
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, r15d
add esi, 0xbb8
cmp esi, 0x4268
jl 0x14000b5f3
jmp 0x14000b65a
or edi, 0xffffffff
mov rsi, qword [rsp + 0x80]
test byte [rsi], 2
jne 0x14000b692
mov ecx, ebx
call fcn.140006fa0
mov r9, qword [rbp + 8]
mov r8, qword [rbp]
mov edx, 0xc0000433
movzx ecx, r15w
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.140007160
or dword [rsi], 2
mov eax, edi
jmp 0x14000b69b
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret