joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400297fc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140025294
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140029886
cmp byte [rbp - 0x21], r15b
je 0x140029881
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400298bc
call fcn.140027914
test eax, eax
jne 0x1400298a8
cmp byte [rbp - 0x21], r15b
je 0x1400298a0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400298bc
cmp byte [rbp - 0x21], r15b
je 0x1400298b9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140024870
test eax, eax
jne 0x14002995c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140025294
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400298fb
cmp byte [rbp - 0x21], r15b
je 0x140029930
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140029930
call fcn.140027914
test eax, eax
jne 0x14002991c
cmp byte [rbp - 0x21], r15b
je 0x140029915
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140029930
cmp byte [rbp - 0x21], r15b
je 0x14002992d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140024870
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14002995c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14002995f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14002996d
mov rcx, rdi
call fcn.140024820
cmp byte [rbp + 0x3f], r15b
je 0x14002997c
mov rcx, qword [rbp + 0x27]
call fcn.140024820
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002c880
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002c8a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002c8a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x414a20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414bc6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430b40
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414a8b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414aa0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x414ac5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414ad9
cmp rbx, 0x1000
jae 0x414a95
nop dword [rax]
jmp 0x414b49
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x414aed
xor edx, edx
jmp 0x414b40
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430b40
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x414acf
jmp 0x414ab4
call fcn.0045fb60
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00435080
lea rax, [0x004ac73c]
mov ebx, 0x18
call fcn.00435980
mov rax, qword [rsp + 0x38]
call fcn.00435680
lea rax, [0x004ac7fc]
mov ebx, 0x19
call fcn.00435980
mov rax, qword [rsp + 0x30]
nop
call fcn.00435680
call fcn.004352e0
call fcn.00435100
lea rax, [0x004ae9b3]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00433740
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bfc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414a20
Function at 0x414c00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414e2a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00430bc0
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414c79
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x414c8c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414cb0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x414cc4
cmp rbx, 0x1000
jae 0x414c83
jmp 0x414d45
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414cd6
xor esi, esi
jmp 0x414d36
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00430bc0
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x414cba
nop
jmp 0x414ca2
call fcn.0045fb60
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414dc5
call fcn.00435080
lea rax, [0x004acbcb]
mov ebx, 0x19
call fcn.00435980
mov rax, qword [rsp + 0x68]
call fcn.00435680
lea rax, [0x004ac7fc]
mov ebx, 0x19
call fcn.00435980
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00435680
call fcn.004352e0
call fcn.00435100
lea rax, [0x004a9823]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00433740
cmp eax, 0x5af
je 0x414d68
call fcn.00435080
lea rax, [0x004acbcb]
mov ebx, 0x19
nop dword [rax]
call fcn.00435980
mov rax, qword [rsp + 0x38]
call fcn.00435680
lea rax, [0x004ac7fc]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435980
mov eax, dword [rsp + 0x34]
call fcn.00435680
call fcn.004352e0
call fcn.00435100
lea rax, [0x004ae2c7]
mov ebx, 0x1f
call fcn.00433740
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bfc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414c00
Function at 0x41d0e0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00598230], 0
jne 0x41d1cf
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41d1c5
lea rbx, [0x0056a670]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41d1a7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045e640
lea rax, [0x004b0342]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00433740
nop
int3

Function at 0x41f5c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41f6be
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x41f600
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x41f6af
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00420180
nop dword [rax]
test rax, rax
je 0x41f6af
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x0041f700]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045be80
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x41f69d
xor eax, eax
jmp 0x41f6a7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x41f5f2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045bfc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041f5c0
Function at 0x441e80
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x441fea
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x441e98
cmp edx, ecx
jne 0x441fd8
nop dword [rax]
test rsi, rsi
jne 0x441fd8
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x441ef4
nop
call fcn.0045ffc0
xorps xmm15, xmm15
mov r14, qword [0x00598400]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00441d80
mov rcx, qword [0x00545528]
mov rdx, qword [0x00545520]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x441fd3
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x441fc8
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x00545f30]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x00545f30], rbx
nop
mov edx, 1
lea rsi, [0x00545f38]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x441fb7
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004afb18]
mov ebx, 0x28
call fcn.00433740
mov rcx, rax
mov rax, rsi
call fcn.0045e620
call fcn.00431d60
lea rax, [0x004aef22]
mov ebx, 0x23
call fcn.00433740
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bfc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00441e80
Function at 0x14000148a
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x260
mov edi, r8d
mov ebx, r8d
lea r9, [rsp + 0x48]
mov r12, rcx
and edi, 0x300
mov r13, rdx
mov r8d, edi
or r8d, 9
call fcn.140007811
test eax, eax
jne 0x140001586
test bl, 2
lea rsi, [rsp + 0x56]
je 0x140001518
xor edx, edx
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x44]
mov r8, rsi
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x140001557
mov r14d, ebx
mov rbp, qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
and r14d, 1
jmp 0x140001537
mov r8d, ebx
mov rdx, rsi
call fcn.14000148a
test eax, eax
jne 0x140001569
xor edx, edx
mov rcx, qword [rsp + 0x48]
mov r9d, 0x105
mov r8, rsi
call rbp
test eax, eax
jne 0x140001569
mov rcx, qword [rsp + 0x48]
test r14d, r14d
je 0x140001528
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x140001586
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
mov r8d, edi
mov rdx, r13
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
add rsp, 0x260
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140003cc7
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x38
mov r8d, ecx
mov rcx, qword [0x1400341c0]
test r8d, r8d
je 0x140003cf2
test rcx, rcx
je 0x140003ce5
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x1400341c0], 0
jmp 0x140003d52
test rcx, rcx
je 0x140003d02
xor ecx, ecx
add rsp, 0x38
jmp fcn.1400086e6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x140020140]
jbe 0x140003d52
mov rax, qword [0x14000d110]
lea r9, [0x140003c30]
xor r8d, r8d
mov edx, 0x6f
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov edx, 5
mov rcx, rax
mov qword [0x1400341c0], rax
add rsp, 0x38
jmp qword [sym.imp.USER32.dll_ShowWindow]
add rsp, 0x38
ret

Function at 0x140003d57
Capabilities:
Read file on windows

Disassembly:
mov r8d, edx
mov rdx, rcx
mov rcx, qword [0x14000a020]
jmp fcn.140007690
Function at 0x140003d7f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov ebx, 0x8000
lea rdi, [0x1400241c0]
test r8, r8
mov qword [rsp + 0x118], rdx
mov r13, r8
mov r12d, r9d
cmovne ebx, r9d
cmovne rdi, r8
test ecx, ecx
js 0x140003dca
movsxd rcx, ecx
add rcx, qword [0x1400201b4]
call fcn.140003d69
lea rcx, [rsp + 0x3c]
mov edx, 4
call fcn.140003d57
test eax, eax
je 0x140003f7e
mov r9d, dword [rsp + 0x3c]
test r9d, r9d
jns 0x140003f8e
mov r15, qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r12d, r12d
call r15
mov ebp, dword [rsp + 0x3c]
mov byte [0x1400341fc], 0xb
mov dword [0x140034214], 0
mov r14d, eax
and ebp, 0x7fffffff
mov dword [rsp + 0x3c], ebp
mov esi, dword [rsp + 0x3c]
test esi, esi
jle 0x140003fbd
cmp esi, 0x4000
mov eax, 0x4000
lea rcx, [0x1400201c0]
cmovg esi, eax
mov edx, esi
call fcn.140003d57
test eax, eax
je 0x140003f7e
lea rax, [0x1400201c0]
sub dword [rsp + 0x3c], esi
mov qword [0x1400341e0], rax
mov dword [0x1400341e8], esi
lea rcx, [0x1400341e0]
mov qword [0x1400341f0], rdi
mov dword [0x1400341f8], ebx
call fcn.140008830
mov dword [rsp + 0x28], eax
test eax, eax
js 0x140003f86
mov rsi, qword [0x1400341f0]
call r15
mov r9d, eax
mov rax, qword [0x14000d0e0]
sub rsi, rdi
test byte [rax + 0x34], 1
je 0x140003eff
mov edx, r9d
mov eax, dword [rsp + 0x3c]
sub edx, r14d
cmp edx, 0xc8
ja 0x140003ebe
test eax, eax
jne 0x140003eff
mov ecx, ebp
mov dword [rsp + 0x2c], r9d
lea r14, [rsp + 0x40]
mov r8d, ebp
sub ecx, eax
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rcx, r14
lea rdx, str....__d__
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, r14
xor ecx, ecx
call fcn.140006c19
mov r9d, dword [rsp + 0x2c]
mov r14d, r9d
test esi, esi
je 0x140003e1e
test r13, r13
jne 0x140003f2c
mov rcx, qword [rsp + 0x118]
mov r8d, esi
mov rdx, rdi
call fcn.1400076bf
test eax, eax
je 0x140003fb7
add r12d, esi
jmp 0x140003f38
mov rdi, qword [0x1400341f0]
add r12d, esi
sub ebx, esi
cmp dword [rsp + 0x28], 4
jne 0x140003e66
jmp 0x140003fbd
mov rcx, qword [rsp + 0x118]
mov r8d, esi
mov rdx, rdi
call fcn.1400076bf
test eax, eax
je 0x140003fb7
sub dword [rsp + 0x3c], esi
add r12d, esi
mov esi, dword [rsp + 0x3c]
test esi, esi
jle 0x140003fbd
cmp esi, ebx
mov rcx, rdi
cmovg esi, ebx
mov edx, esi
call fcn.140003d57
test eax, eax
jne 0x140003f45
mov r12d, 0xfffffffd
jmp 0x140003fbd
mov r12d, 0xfffffffc
jmp 0x140003fbd
test r13, r13
jne 0x140003f9f
xor r12d, r12d
lea rdi, [0x1400201c0]
jmp 0x140003f63
cmp r9d, r12d
mov rcx, r13
cmovle r12d, r9d
mov edx, r12d
call fcn.140003d57
test eax, eax
jne 0x140003fbd
jmp 0x140003f7e
mov r12d, 0xfffffffe
mov eax, r12d
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400042b0
Capabilities:
Get common file path

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov rax, qword [0x14000d180]
mov rbx, qword [rax]
lea r12, [rbx + 0x32000]
mov rcx, r12
call fcn.140007aa8
mov rcx, r12
call fcn.140007412
test eax, eax
je 0x140004302
mov rcx, r12
call fcn.140007a32
mov rcx, r12
call fcn.140007269
lea rcx, [rbx + 0x30000]
mov rdx, r12
add rsp, 0x28
pop rbx
pop r12
jmp fcn.140007624
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret

Function at 0x14000430c
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x14000d0d0]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14000432e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0xffffffffffffffff
call fcn.1400049a5
mov rax, qword [0x14000d180]
mov edx, 7
mov rcx, qword [rax]
add rcx, 0x34000
add rsp, 0x20
pop rbx
jmp fcn.140008027
Function at 0x140007200
Capabilities:
Create directory

Disassembly:
sub rsp, 0x68
lea rax, [0x14000c950]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x48], rax
sub rax, 0x10
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x40001
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x20], 0x18
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x140007264
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x68
ret

Function at 0x140007269
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140007284
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000728b
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x78
xor r8d, r8d
xor r9d, r9d
mov dword [0x1403d06e0], 0x68
lea rax, [rsp + 0x58]
mov rdx, rcx
xor ecx, ecx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
lea rax, [0x1403d06e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r8d, eax
xor eax, eax
test r8d, r8d
je 0x1400072fc
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x58]
add rsp, 0x78
ret

Function at 0x140007301
Capabilities:
Create process on windows

Disassembly:
mov dword [rcx], 0x70
mov qword [rcx + 0x40], 0
jmp qword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x140007545
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push r12
sub rsp, 0x20
mov qword [rsp + 0x30], rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r12d, eax
cmp eax, 0xffffffff
je 0x14000756e
mov edx, eax
mov rcx, qword [rsp + 0x30]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, r12d
add rsp, 0x20
pop r12
ret

Function at 0x140007578
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r12, rcx
mov ebx, edx
call fcn.140007545
mov r13d, eax
cmp eax, 0xffffffff
jne 0x140007597
xor ebx, ebx
jmp 0x1400075cb
mov rcx, r12
test bl, 1
je 0x1400075c3
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400075bc
and ebx, 4
jne 0x140007593
mov edx, r13d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1400075cb
mov ebx, 1
jmp 0x1400075cb
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400075a5
mov eax, ebx
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
Function at 0x1400075d7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov dword [rsp + 0x58], edx
mov ebx, r8d
mov qword [rsp + 0x50], rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x50]
mov edx, dword [rsp + 0x58]
cmp eax, 0xffffffff
jne 0x1400075fe
xor eax, eax
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov r8d, 1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
add rsp, 0x40
pop rbx
ret

Function at 0x140007624
Capabilities:
Get common file path

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov ebx, 0x65
movabs rdi, 0x610073006e
mov r12, rcx
mov rsi, rdx
dec ebx
je 0x140007679
mov qword [rsp + 0x28], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
xor r8d, r8d
div ecx
mov r9, r12
mov rcx, rsi
add word [rsp + 0x2c], dx
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140007642
jmp 0x140007683
mov word [r12], 0
xor r12d, r12d
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x140007690
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0
mov ebx, r8d
lea r9, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400076b9
xor eax, eax
cmp dword [rsp + 0x3c], ebx
sete al
add rsp, 0x40
pop rbx
ret

Function at 0x1400076bf
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0
mov ebx, r8d
lea r9, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400076e8
xor eax, eax
cmp dword [rsp + 0x3c], ebx
sete al
add rsp, 0x40
pop rbx
ret

Function at 0x140007795
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rax, qword [0x14000d0e0]
inc dword [rax + 0x10]
add rsp, 0x28
ret

Function at 0x1400078ad
Capabilities:
Query or enumerate registry value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov r12, r8
mov r8d, dword [rsp + 0x80]
mov dword [rsp + 0x30], 0x2000
mov rbx, r9
test r8d, r8d
je 0x1400078d6
mov r8d, 0x200
or r8d, 0x20019
lea r9, [rsp + 0x38]
call fcn.140007811
test eax, eax
je 0x1400078f2
mov word [rbx], 0
jmp 0x14000793c
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, r12
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [rbx + 0x1ffe], 0
test esi, esi
jne 0x1400078eb
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x1400078eb
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret