joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027de0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b784
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b784
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027f30
cmp rax, 0xffffffffffffffff
je 0x140027f30
xor edi, edi
test rbp, rbp
jle 0x140027edb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001dd70
mov rbx, rax
test rax, rax
jne 0x140027e68
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027ed1
mov edx, 0x8000
mov ecx, r14d
call fcn.140015928
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c460
cmp eax, 0xffffffff
je 0x140027eb1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027e78
mov edx, r15d
mov ecx, r14d
call fcn.140015928
jmp 0x140027ed1
cmp byte [rsi + 0x38], dil
je 0x140027ec8
cmp dword [rsi + 0x34], 5
jne 0x140027ec8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027ed1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019e48
jmp 0x140027f44
jns 0x140027f44
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b784
cmp rax, 0xffffffffffffffff
jne 0x140027efc
cmp byte [rsi + 0x30], dil
je 0x140027f44
mov edi, dword [rsi + 0x2c]
jmp 0x140027f44
mov ecx, r14d
call fcn.140016f28
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027f44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027f44
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027f3d
mov eax, dword [rsi + 0x2c]
jmp 0x140027f42
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b784
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x180024200
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180024228
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180024228
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x18002a830
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
test edx, edx
je 0x18002a84d
mov eax, 1
cmp edx, eax
jne 0x18002a8a2
mov qword [0x180075668], rcx
add rsp, 0x28
ret
cmp qword [0x180060a70], 0
je 0x18002a89d
cmp qword [0x180060a78], 8
mov qword [rsp + 0x20], rbx
lea rbx, [0x180060a60]
mov rcx, rbx
cmovae rcx, qword [0x180060a60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [0x180060a78], 8
cmovae rbx, qword [0x180060a60]
xor eax, eax
mov qword [0x180060a70], rax
mov word [rbx], ax
mov rbx, qword [rsp + 0x20]
mov eax, 1
add rsp, 0x28
ret
Function at 0x14000e678
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x1400b3010]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov rcx, rdx
mov rbx, r8
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x410
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rbx]
cmp dword [r8 + 4], 0
je 0x14000e6f3
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
mov r9, rdi
lea r8, str.__s___s
lea rcx, [rbp]
mov qword [rsp + 0x20], rax
mov edx, 0x410
call fcn.140003ffc
and qword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000e823
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
and qword [rsp + 0x68], 0
mov r9d, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x20f01ff
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
and qword [rsp + 0x70], 0
xor r8d, r8d
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
xor eax, eax
lea rcx, [rbp - 0x70]
xorps xmm0, xmm0
mov qword [rbp - 0x78], rax
xor edx, edx
movups xmmword [rsp + 0x78], xmm0
lea ebx, [rax + 0x70]
mov r8d, ebx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x68]
lea rax, str.winsta0default
mov qword [rbp - 0x60], rax
lea r8, [rbp]
lea rax, [rsp + 0x78]
mov dword [rbp - 0x70], ebx
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rbp - 0x70]
mov rdx, rdi
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x628
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
setne bl
test eax, eax
je 0x14000e7fa
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test bl, bl
je 0x14000e823
mov al, 1
jmp 0x14000e825
xor al, al
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140016780
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400177a0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x1400177dd
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.14001698c
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400178dc
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14001698c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x140017850
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.140003ef4
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x14001791b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001791b
call fcn.1400167f8
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x140017902
mov rcx, r14
call fcn.1400167f8
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x140009064
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14027eb40]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rdx
mov r14, rcx
xor r12d, r12d
mov esi, r12d
cmp dword [rcx + 0x358], r12d
jle 0x1400091c4
cmp rdx, 0xffffffffffffffff
je 0x1400091c4
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
lea r13d, [r12 + 7]
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
lea r8d, [r12 + 0x1a]
lea rdx, str.____Queued_Lines_End_____r_n
lea rcx, [rbp - 0x30]
call fcn.140004e30
nop
lea rbx, [r14 + 0x338]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.14000b7e8
nop
cmp qword [rbp - 0x18], 8
jb 0x14000910a
mov rcx, qword [rbp - 0x30]
call fcn.14001ae84
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
jmp 0x1400091b7
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.14000c014
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x140009138
mov rax, r12
jmp 0x14000913b
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
dec rcx
and rcx, qword [rdx + 0x10]
mov rax, qword [rax + 8]
mov rdx, qword [rax + rcx*8]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14000915c
mov rdx, qword [rdx]
lea r8d, [rax + rax]
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140009179
add esi, dword [rbp - 0x40]
mov rcx, qword [rbx + 0x10]
dec rcx
and rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 8]
mov rdi, qword [rax + rcx*8]
cmp qword [rdi + 0x18], 8
jb 0x14000919b
mov rcx, qword [rdi]
call fcn.14001ae84
mov qword [rdi + 0x18], r13
mov qword [rdi + 0x10], r12
mov word [rdi], r12w
dec qword [rbx + 0x20]
jne 0x1400091b3
mov qword [rbx + 0x18], r12
jmp 0x1400091b7
inc qword [rbx + 0x18]
cmp qword [r14 + 0x358], r12
ja 0x14000911c
mov eax, esi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140199450
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009ff4
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov rax, qword [0x14027eb40]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rbp + 0x58]
xor r15d, r15d
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r15
mov word [rbp - 0x30], r15w
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov edx, dword [rdx + 0x10]
call fcn.140009be0
bt ebx, 0x1b
jb 0x14000a063
test dword [rsi + 0x10], 0x80000
je 0x14000a0c3
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rdi + 0x90]
test rcx, rcx
je 0x14000a092
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x14000a092
add rcx, 0x30
jmp 0x14000a09d
mov rcx, qword [rdi + 0xe0]
add rcx, 0x28
cmp qword [rcx + 0x18], 8
jb 0x14000a0a7
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x140234c90]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14000a0dc
add rcx, 8
cmp qword [rcx + 0x18], 8
jb 0x14000a0e3
mov rcx, qword [rcx]
jmp 0x14000a0e3
lea rcx, [0x140234670]
call fcn.14019a0c8
test rax, rax
jne 0x14000a0f6
cmp qword [rdi + 0x360], r15
je 0x14000a112
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r8, qword [rbp - 0x30]
mov r9, r14
mov rdx, rsi
mov rcx, rdi
call fcn.1400091ec
test dword [rsi + 0x10], 0x10000000
je 0x14000a129
lea rcx, [rdi + 0xb8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
nop
cmp qword [rbp - 0x18], 8
jb 0x14000a139
mov rcx, qword [rbp - 0x30]
call fcn.14001ae84
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r15
mov word [rbp - 0x30], r15w
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140199450
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000a164
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x840
mov rax, qword [0x14027eb40]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rsi, rcx
mov r8d, edx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x14000a1fc
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov r8d, 0x800
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x14000a1f3
test dword [rsp + 0x20], 0xfffffff8
jbe 0x14000a1f3
mov ecx, ebx
lea rdx, [rsi + 0x110]
mov r8d, 0x104
mov rcx, qword [rsp + rcx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [rsp + 0x20]
inc ebx
shr eax, 3
cmp ebx, eax
jb 0x14000a1cc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140199450
lea r11, [rsp + 0x840]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000d7e8
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x14000d838
mov r11, rsp
push rbx
sub rsp, 0x40
mov rbx, r8
test rbx, rbx
je 0x14000d833
lea rax, [r11 + 8]
lea r9, [r11 + 0x20]
xor r8d, r8d
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x18]
mov dword [rsp + 0x50], 4
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d833
cmp dword [rsp + 0x68], 4
jne 0x14000d833
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
add rsp, 0x40
pop rbx
ret

Function at 0x14000d83c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
lea rax, [r11 + 0x20]
mov r15, r8
xor ebx, ebx
mov qword [r11 - 0x30], rax
lea r9, [r11 - 0x28]
xor r8d, r8d
mov qword [r11 - 0x38], rbx
mov rbp, rdx
mov r14, rcx
mov dword [rsp + 0x78], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d8fb
cmp dword [rsp + 0x30], 1
jne 0x14000d8fb
mov ecx, dword [rsp + 0x78]
lea eax, [rbx + 2]
lea rsi, [rbx - 1]
shr ecx, 1
inc ecx
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.14001ae8c
mov rdi, rax
test rax, rax
je 0x14000d8fb
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d8f3
cmp word [rdi], bx
je 0x14000d8e5
inc rsi
cmp word [rdi + rsi*2], bx
jne 0x14000d8d9
mov rbx, rsi
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call fcn.140004e30
mov rcx, rdi
call fcn.14001ae84
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14001320c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
movzx eax, word [rcx + 0x13a]
mov r14, rcx
mov ecx, 0x3ff
and ax, cx
or r15, 0xffffffffffffffff
cmp ax, 1
je 0x14001325b
cmp ax, 0xd
je 0x14001325b
mov rcx, r14
call fcn.140021b34
mov r15, rax
jmp 0x14001332d
mov rdx, qword [r14 + 0xe0]
mov rbp, qword [r14 + 0xf0]
xor r12b, r12b
test rdx, rdx
je 0x140013285
test rbp, rbp
jne 0x140013285
call fcn.1400133ac
test rax, rax
mov rbp, rax
setne r12b
mov rcx, qword [r14 + 0xe8]
test rcx, rcx
je 0x14001329f
test rbp, rbp
jne 0x1400132a4
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rbp, rbp
je 0x14001331a
mov eax, 0xffff
cmp word [rbp + 2], ax
mov eax, 0x400000
jne 0x1400132c2
mov ecx, dword [rbp + 8]
test eax, ecx
jne 0x1400132ce
or ecx, eax
mov dword [rbp + 8], ecx
jmp 0x1400132ce
mov ecx, dword [rbp + 4]
test eax, ecx
jne 0x1400132ce
or ecx, eax
mov dword [rbp + 4], ecx
mov rsi, qword [r14 + 0xe0]
mov rdi, qword [r14 + 0xe8]
mov rbx, qword [r14 + 0xf0]
and qword [r14 + 0xe0], 0
and qword [r14 + 0xe8], 0
mov rcx, r14
mov qword [r14 + 0xf0], rbp
call fcn.140021b34
mov qword [r14 + 0xf0], rbx
mov qword [r14 + 0xe8], rdi
mov qword [r14 + 0xe0], rsi
mov r15, rax
test r12b, r12b
je 0x14001332d
test rbp, rbp
je 0x14001332d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rax, r15
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400133ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rdx
test rdx, rdx
je 0x140013442
call fcn.14002b538
lea r8d, [rbx + 5]
mov rdx, rdi
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140013442
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140013442
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x140013442
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x140013442
lea ecx, [rbx + 0x40]
mov edx, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x140013442
mov r9d, edi
mov r8, rbp
mov edx, edi
mov rcx, rax
call fcn.140199cd0
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001350c
Capabilities:
Identify system language via api

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x50
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
movzx eax, r8w
mov rsi, rdx
mov edi, ecx
xor ebx, ebx
test r8w, r8w
jne 0x14001353f
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov qword [rsp + 0x78], rbx
movzx r9d, ax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x1400135e8
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140013584
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, edi
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x1400135e8
mov rax, qword [rsp + 0x78]
test rax, rax
jne 0x1400135cc
lea edx, [rax + 0x64]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x20], edi
mov r9d, edi
lea r8, str._u__0x_08X__error
mov edx, 0x32
mov rcx, rax
call fcn.14019a644
nop
jmp 0x1400135f1
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140013641
mov qword [rsp + 0x40], rbx
lea r8, [rsp + 0x40]
lea rdx, [0x14023486c]
call fcn.1401b85f8
mov rdx, qword [rsp + 0x78]
cmp word [rdx], bx
je 0x14001362b
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], bx
jne 0x14001361f
mov rbx, rax
mov r8, rbx
mov rcx, rsi
call fcn.140004e30
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400165a8
Capabilities:
Get file version info

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push r14
sub rsp, 0x30
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov r14, rdx
mov rbx, rcx
lea rax, vtable.NGUtils::AFileVersionInfo.0
mov qword [rcx], rax
lea rax, vtable.NGUtils::CFileVersionInfo.0
mov qword [rcx], rax
and dword [rcx + 0x10], 0
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
and qword [rcx + 8], 0
test rdx, rdx
je 0x14001669e
and dword [rsp + 0x60], 0
lea rdx, [r11 + 0x18]
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
mov dword [rsp + 0x68], esi
test eax, eax
je 0x14001669e
mov ecx, esi
call fcn.14001ae8c
mov qword [rbx + 0x18], rax
jmp 0x140016634
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14001669e
mov r8d, esi
mov edx, dword [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14001669e
and dword [rsp + 0x58], 0
and dword [rsp + 0x68], 0
lea r8, [rbx + 0x20]
lea r9, [rsp + 0x58]
lea rdx, str.VarFileInfoTranslation
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140016683
mov eax, dword [rsp + 0x58]
shr eax, 2
mov dword [rbx + 0x10], eax
lea r8, [rbx + 8]
lea r9, [rsp + 0x68]
lea rdx, [0x140234bf8]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop
mov rax, rbx
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x1400174f8
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x100
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14027eb40]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x1ac
lea r9, str.NGUtils::CFileUtils::DeleteFileW
lea r8, [0x140293698]
mov rdx, qword [0x140292b88]
lea rcx, [rsp + 0x50]
call fcn.14000593c
nop
cmp qword [rbx + 0x18], 8
jb 0x14001755d
mov rcx, qword [rbx]
jmp 0x140017560
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x140017620
mov sil, 1
test sil, al
je 0x1400175d2
and edi, 0xfffffffe
cmp qword [rbx + 0x18], 8
jb 0x140017588
mov rcx, qword [rbx]
jmp 0x14001758b
mov rcx, rbx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1400175d2
cmp qword [rbx + 0x18], 8
jb 0x1400175a1
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
lea r9, str.::SetFileAttributes__s__0x_X___error_d
mov edx, 0x80
mov r8d, 0x1bb
lea rcx, [rsp + 0x50]
call fcn.140005d14
jmp 0x140017620
cmp qword [rbx + 0x18], 8
jb 0x1400175de
mov rcx, qword [rbx]
jmp 0x1400175e1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140017623
cmp qword [rbx + 0x18], 8
jb 0x1400175f5
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea r9, str.::DeleteFile__s___error_d
mov edx, 0x80
mov r8d, 0x1c2
lea rcx, [rsp + 0x50]
call fcn.140005d14
xor sil, sil
lea rcx, [rsp + 0x50]
call fcn.1400059c8
mov al, sil
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140199450
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140017ad4
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r12, r8
mov r13, rdx
mov r15, rcx
or rsi, 0xffffffffffffffff
mov ebp, ebx
mov edi, ebx
add ebp, 0x200
test rdi, rdi
je 0x140017b1a
mov rcx, rdi
call fcn.14001ae84
mov ecx, ebp
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.14001ae8c
mov rdi, rax
test rax, rax
je 0x140017ba4
mov word [rax], bx
lea rax, [r15 + 8]
cmp qword [rax + 0x18], 8
jb 0x140017b49
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
lea r8, [0x140234670]
mov r9, rdi
mov rdx, r12
mov rcx, r13
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov r14d, eax
lea eax, [rbp - 1]
cmp r14d, eax
jae 0x140017b07
cmp word [rdi], bx
jne 0x140017b7d
mov rsi, rbx
jmp 0x140017b86
inc rsi
cmp word [rdi + rsi*2], bx
jne 0x140017b7d
mov rcx, qword [rsp + 0x78]
mov r8, rsi
mov rdx, rdi
call fcn.140004e30
mov rcx, rdi
call fcn.14001ae84
test r14d, r14d
setne al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret