joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802ddf40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x50
call fcn.1800b8100
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rsi, rcx
mov rdi, qword [rcx + 0x160]
mov r14, r9
mov qword [rsp + 0x30], rax
mov r15, r8
mov rax, qword [rcx + 0x168]
mov rbp, rdx
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rax
add rcx, r9
movabs rax, 0xfffffffe0
cmp rcx, rax
ja 0x1802de19e
cmp rcx, r9
jb 0x1802de19e
cmp dword [rsi + 0x174], 0
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x48], r12
mov qword [rsi + 0x38], rcx
je 0x1802ddfd1
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov dword [rsi + 0x174], 0
mov ebx, dword [rsi + 0x170]
mov r12d, dword [rsi + 0xc]
mov dword [rsp + 0x80], ebx
bswap r12d
test ebx, ebx
je 0x1802de031
nop dword [rax]
test r14, r14
je 0x1802de01f
mov ecx, ebx
dec r14
movzx eax, byte [rcx + rsi + 0x10]
xor al, byte [rbp]
inc rbp
mov byte [r15], al
inc r15
xor byte [rcx + rsi + 0x40], al
inc ebx
and ebx, 0xf
mov dword [rsp + 0x80], ebx
jne 0x1802ddff0
jmp 0x1802de027
test ebx, ebx
jne 0x1802de17d
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov r10, qword [rsp + 0xa0]
mov qword [rsp + 0x40], r13
cmp r14, 0xc00
jb 0x1802de0e6
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add r14, rax
mov qword [rsp + 0x98], r14
mov r14, qword [rsp + 0x30]
nop word [rax + rax]
mov r9, r14
mov qword [rsp + 0x20], rsi
mov r8d, 0xc0
mov rdx, r15
mov rcx, rbp
call r10
add r12d, 0xc0
lea rdx, [rsi + 0x60]
mov eax, r12d
lea rcx, [rsi + 0x40]
bswap eax
mov r9d, 0xc00
mov dword [rsi + 0xc], eax
mov r8, r15
call qword [rsp + gethostname]
mov r10, qword [rsp + 0xa0]
add r15, 0xc00
add rbp, 0xc00
sub rdi, 1
jne 0x1802de080
mov ebx, dword [rsp + 0x80]
mov r14, qword [rsp + 0x98]
mov r13, r14
and r13, 0xfffffffffffffff0
je 0x1802de132
mov r9, qword [rsp + 0x30]
mov rdi, r13
shr rdi, 4
mov rdx, r15
mov r8, rdi
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call r10
add r12d, edi
lea rdx, [rsi + 0x60]
mov eax, r12d
lea rcx, [rsi + 0x40]
bswap eax
mov r9, r13
mov dword [rsi + 0xc], eax
mov r8, r15
add rbp, r13
sub r14, r13
call qword [rsp + gethostname]
add r15, r13
mov r13, qword [rsp + 0x40]
test r14, r14
je 0x1802de17d
mov r8, qword [rsp + 0x30]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call qword [rsi + 0x178]
inc r12d
bswap r12d
mov dword [rsi + 0xc], r12d
nop dword [rax + rax]
mov ecx, ebx
inc ebx
movzx edx, byte [rcx + rbp]
movzx eax, byte [rsi + rcx + 0x10]
xor edx, eax
mov byte [rcx + r15], dl
xor byte [rcx + rsi + 0x40], dl
sub r14, 1
jne 0x1802de160
mov r12, qword [rsp + 0x48]
xor eax, eax
mov dword [rsi + 0x170], ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
or eax, 0xffffffff
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1802de380
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
push r14
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1800b8100
sub rsp, rax
mov r13, qword [rcx + 0x160]
xor r14d, r14d
mov qword [rcx], r14
mov rsi, r8
mov qword [rcx + 8], r14
mov rdi, rdx
mov qword [rcx + 0x40], r14
mov rbx, rcx
mov qword [rcx + 0x48], r14
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x38], r14
mov qword [rcx + 0x170], r14
cmp r8, 0xc
jne 0x1802de3e7
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov byte [rcx + 0xf], 1
jmp 0x1802de559
mov qword [rsp + 0x58], rbp
mov rbp, rsi
mov qword [rsp + 0x50], rsi
cmp rsi, 0x10
jb 0x1802de493
mov qword [rsp + 0x60], r12
mov r12, rbx
shr rbp, 4
neg r12
imul rax, rbp, 0xfffffffffffffff0
mov qword [rsp + 0x68], r15
lea r15, [rcx + 0xf]
add rsi, rax
nop dword [rax]
lea r8, [r12 + rdi]
lea rax, [r8 + r15]
cmp rbx, rax
ja 0x1802de460
cmp r15, rdi
jb 0x1802de460
mov rax, rbx
mov edx, reloc.WS2_32.dll_recv
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1802de440
jmp 0x1802de470
movdqu xmm1, xmmword [rbx]
movdqu xmm0, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
add rdi, 0x10
sub rbp, 1
jne 0x1802de420
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
test rsi, rsi
je 0x1802de53a
cmp rsi, 0x20
jb 0x1802de503
lea rcx, [rbx - 1]
lea rax, [rdi - 1]
add rcx, rsi
add rax, rsi
cmp rbx, rax
ja 0x1802de4ba
cmp rcx, rdi
jae 0x1802de503
mov rdx, rsi
mov rcx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rbx
sub rcx, rbx
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add r14, 0x20
movdqu xmm1, xmmword [rax + rcx]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm0, xmmword [rax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp r14, rdx
jb 0x1802de4d0
cmp r14, rsi
jae 0x1802de530
sub rdi, rbx
lea rcx, [r14 + rbx]
sub rsi, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rsi, 1
jne 0x1802de520
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
shl rbp, 3
lea rdx, [rbx + 0x60]
bswap rbp
xor qword [rbx + 8], rbp
mov rcx, rbx
call r13
mov edi, dword [rbx + 0xc]
mov rbp, qword [rsp + 0x58]
bswap edi
mov r8, qword [rbx + 0x180]
lea rdx, [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x178]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x20
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret

Function at 0x1802e3890
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1800b8100
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1802e38b9
lea rax, [0x1802e1e60]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1802dc9a0
lea rax, [0x1802e0fc0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1802dc6d0
Function at 0x1802faea0
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
push rbx
mov eax, Ordinal_211
call fcn.1800b8100
sub rsp, rax
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, 0x40
test eax, eax
je 0x1802faf32
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1802faf25
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1802faf16
addsd xmm2, qword [0x180334f18]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.1802758f0
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r9d, reloc.WLDAP32.dll_Ordinal_22
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1802fafa2
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1802faf95
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1802faf86
addsd xmm2, qword [0x180334f18]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.1802758f0
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x1802fafdd
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1802fafc2
mov dword [reloc.WS2_32.dll_accept], eax
jmp 0x1802fafdd
xorps xmm2, xmm2
lea rcx, [rsp + 0x40]
mov edx, 8
call fcn.1802758f0
cmp dword [reloc.WS2_32.dll_accept], 0
jne 0x1802faff9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 4
mov dword [rsp + 0x38], eax
call fcn.1802758f0
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
movsd xmm2, qword [0x180334ef8]
lea rcx, [rsp + 0x48]
mov edx, gethostname
call fcn.1802758f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsd xmm2, qword [0x180334ef8]
lea rcx, [rsp + 0x3c]
mov edx, 4
mov dword [rsp + 0x3c], eax
call fcn.1802758f0
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800b80c0
add rsp, 0xd0
pop rbx
ret
Function at 0x18031fb79
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18031fd6a
push rbx
mov eax, Ordinal_211
call fcn.1800b8100
sub rsp, rax
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.18027d970
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.18027d6c0
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1802c3870
mov rcx, r15
call fcn.18027d970
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.18027d6c0
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1802c3870
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x18031fbe0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800b80c0
add rsp, 0xd0
pop rbx
ret
Function at 0x140026370
Capabilities:
Check mutex on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], 0
mov qword [rcx + 8], 0
lea r8, str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400263b0
mov rcx, rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [rsi]
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x140041cb0
Capabilities:
Get session information

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x140041d75
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rcx, [rsp + 0x44]
mov dword [rcx], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov edx, eax
mov r8d, 0x18
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x140041d75
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x38]
mov qword [r14], rax
mov rdi, qword [rsp + 0x48]
mov ecx, 0x30
call fcn.140100528
mov rbx, rax
lea rdx, [0x1400427e0]
lea r8, [0x1400260d0]
mov rcx, rax
call fcn.1400d6cd0
lea rax, [0x1401cb610]
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rdi
lea rdx, [rsp + 0x30]
mov qword [rdx], rbx
mov rcx, r14
call fcn.1400e3d20
cmp dword [rsp + 0x44], 0xd7
ja 0x140041d7e
mov qword [rsi], 0
jmp 0x140041d92
mov qword [rsi], 0
jmp 0x140041d9c
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0xc8]
mov rcx, rsi
call fcn.140077600
lea rcx, [rsp + 0x38]
call fcn.1400e3d50
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401013e0
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400456f0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x14021b270]
test rdi, rdi
jne 0x140045793
mov ecx, 0x48
call fcn.140100528
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.140100528
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x14021b270], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400457b5
mov rcx, rax
call fcn.14011bf14
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.1400457c0
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401013e0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140045782
Function at 0x140048670
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov rbx, qword [rdx]
mov qword [rdx], rax
lea rbp, [rbx + 1]
cmp rbp, 2
jb 0x14004869f
call fcn.1400d9600
cmp qword [rsi], rbx
je 0x1400486d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14004870d
cmp rbp, 2
jb 0x1400486c7
mov qword [rsi], rbx
call fcn.1400d9600
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.1400d7a40
lea rcx, [rsi + 0x20]
call fcn.1400e5340
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], r14b
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140048723
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400d9600
mov rcx, qword [rsi]
call fcn.1400e0e60
mov qword [rsi], 0
jmp 0x1400486b9
call fcn.1400d9600
mov rcx, qword [rdi]
call fcn.1400e0e60
mov qword [rdi], 0
jmp 0x1400486fd

Function at 0x140048740
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400e0970
mov qword [rsi], 0
test rax, rax
je 0x140048793
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400487c7
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14004878b
mov qword [rsi], rbx
call fcn.1400d9600
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.1400d7a60
lea rcx, [rsi + 0x20]
call fcn.1400e5340
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1400d9600
mov rcx, qword [rsi]
call fcn.1400e0e60
mov qword [rsi], 0
jmp 0x140048779
Function at 0x14004a320
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.1400d6e30
test al, al
je 0x14004a379
call fcn.1400d6e20
mov rdi, rax
lea rbx, [0x1401eeb91]
mov rcx, rax
mov rdx, rbx
call fcn.1400d6e40
test al, al
jne 0x14004a3a8
lea rdx, str.vmodule
mov rcx, rdi
call fcn.1400d6e40
test al, al
jne 0x14004a3a8
mov eax, dword [rsi]
mov dword [0x140215348], eax
mov bl, 1
test al, 1
jne 0x14004a469
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401013e0
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp qword [0x14021b280], 0
jne 0x14004a4fa
mov rax, qword [0x14021b288]
mov qword [0x14021b280], rax
mov ecx, 0x20
call fcn.140100528
mov r14, rax
lea rcx, str.vmodule
lea r15, [rsp + 0x48]
mov qword [r15], rcx
call fcn.14011bc60
mov qword [r15 + 8], rax
lea r12, [rsp + 0x58]
mov rcx, rdi
mov rdx, r12
mov r8, r15
call fcn.1400d6f50
lea r15, [rsp + 0x20]
mov qword [r15], rbx
mov rcx, rbx
call fcn.14011bc60
mov qword [r15 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
mov r8, r15
call fcn.1400d6f50
lea r9, [0x14021b290]
mov rcx, r14
mov rdx, rbx
mov r8, r12
call fcn.140171020
mov qword [0x14021b288], r14
cmp byte [rbx + 0x17], 0
jns 0x14004a44f
mov rcx, qword [rsp + 0x30]
call fcn.140100564
cmp byte [rsp + 0x6f], 0
jns 0x14004a379
mov rcx, qword [rsp + 0x58]
call fcn.140100564
jmp 0x14004a379
mov rcx, qword [0x14021b2b8]
test rcx, rcx
jne 0x14004a483
mov rcx, qword [0x14021b298]
test rcx, rcx
je 0x14004a4a7
jmp 0x14004a4c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14021b2b8], 0
mov rcx, qword [0x14021b298]
test rcx, rcx
jne 0x14004a4c9
and byte [0x140215348], 0xfe
mov ecx, 0x18
call fcn.140100528
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x14021b298], rax
mov rdx, qword [rsi + 8]
call fcn.1400d5f20
cmp dword [rsi + 0x14], 0
jne 0x14004a4ee
mov rcx, qword [0x14021b298]
cmp byte [rcx + 0x17], 0
jns 0x14004a4e8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140158b20
mov ebx, eax
jmp 0x14004a38b
int3
Function at 0x140050a10
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movaps xmm0, xmmword [0x1401d9dd0]
lea rsi, [rsp + 0x50]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.CreateFileVersionInfoWin
lea r8, str..._.._base_file_version_info_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r9d, 0x4d
call fcn.1400d95e0
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call fcn.1400e5a80
mov dword [rsp + 0x2c], 0xaaaaaaaa
cmp byte [rbx + 0x17], 0
jns 0x140050a96
mov rbx, qword [rbx]
lea rdx, [rsp + 0x2c]
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x140050bba
mov ebp, eax
mov esi, eax
mov rcx, rsi
call fcn.140100528
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.140103d70
mov edx, dword [rsp + 0x2c]
mov rcx, rbx
mov r8d, ebp
mov r9, r15
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140050bc3
lea r8, [rsp + 0x30]
mov qword [r8], 0
lea r9, [rsp + 0xac]
mov dword [r9], 0xaaaaaaaa
lea rdx, str.VarFileInfoTranslation
mov rcx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140050bc3
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140050bc3
mov rdi, r15
add rdi, rsi
mov ecx, 0x38
call fcn.140100528
mov rsi, rax
mov eax, dword [rbx]
lea rcx, fcn.140050fa0
mov qword [rsi], rcx
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
mov qword [rsi + 0x20], r15
mov dword [rsi + 0x28], eax
lea r8, [rsp + 0x30]
mov qword [r8], 0
lea r9, [rsp + 0xac]
mov dword [r9], 0xaaaaaaaa
lea rdx, [0x1401e7a52]
mov rcx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140050bd9
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x30], rax
mov qword [r14], rsi
lea rcx, [rsp + 0x50]
call fcn.1400e5c10
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401013e0
mov rax, r14
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [r14], 0
jmp 0x140050b8d
mov qword [r14], 0
test r15, r15
je 0x140050b8d
mov rcx, r15
call fcn.140100564
jmp 0x140050b8d
int3
Function at 0x140050c70
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov r15, r8
mov r13, rdx
mov rdi, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx r14d, word [rcx + 0x28]
movzx r12d, word [rcx + 0x2a]
mov rsi, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call rsi
mov ebp, eax
movzx ebx, word [rdi + 0x2a]
movzx eax, word [rdi + 0x28]
mov dword [rsp + 0x40], eax
call rsi
mov word [rsp + 0x3e], ax
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140103d70
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r14d
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140050f10
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140050d74
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140050d74
mov r8d, dword [rsp + 0x44]
test r8d, r8d
je 0x140050d74
dec r8d
mov rcx, r15
call fcn.1400d5da0
mov sil, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401013e0
mov eax, esi
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140103d70
movzx eax, bp
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140050f10
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140050df3
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140050df3
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140050d40
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140103d70
mov qword [rsp + 0x30], r13
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140050f10
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140050e77
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140050e77
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140050d40
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140103d70
movzx eax, word [rsp + 0x3e]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140050f10
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140050efc
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140050efc
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140050d40
xor esi, esi
jmp 0x140050d4e