joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a000
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov r14, r9
xor edi, edi
mov rsi, qword [rsp + 0x70]
mov dword [rsi], edi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
mov ecx, edi
lea r15, [0x140000000]
lea rbp, [0x140042670]
nop word [rax + rax]
movzx eax, byte [rcx + r15 + 0x31430]
mov byte [rcx + rbp], al
lea rcx, [rcx + 1]
test al, al
jne 0x14002a050
mov ecx, 0x10
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14002a0ad
mov word [rax], di
mov qword [rax + 8], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x14002a0b0
inc eax
movsxd rcx, eax
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov qword [rbx + 8], rax
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x14002a0b0
mov rbx, rdi
mov edx, 1
mov rcx, rbx
call fcn.14002ab70
mov qword [rsi + 8], rax
test rax, rax
je 0x14002a135
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [r14], eax
cmp eax, 0xffffffff
je 0x14002a135
test rbx, rbx
je 0x14002a0f6
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002a0ed
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
mov rdx, rdi
nop dword [rax]
movzx eax, byte [rdx + r15 + 0x31440]
mov byte [rdx + rbp], al
lea rdx, [rdx + 1]
test al, al
jne 0x14002a100
mov rcx, rbp
call fcn.14002ae90
mov rbx, rax
mov edx, 0xa
mov rcx, rax
call fcn.14002ab70
mov qword [rsi + 0x10], rax
test rax, rax
jne 0x14002a13a
mov edi, 2
test rbx, rbx
je 0x14002a157
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002a14e
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
test edi, edi
je 0x14002a179
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14002a169
call fcn.14002a9e0
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14002a1b4
call fcn.14002a9e0
jmp 0x14002a1b4
lea rcx, [0x140029770]
mov rax, qword [rsp + 0x78]
mov qword [rax], rcx
lea rcx, [0x140029920]
mov qword [rax + 8], rcx
lea rcx, [0x140029ce0]
mov qword [rax + 0x10], rcx
lea rcx, [0x140029a40]
mov qword [rax + 0x18], rcx
lea rcx, [0x140029aa0]
mov qword [rax + 0x20], rcx
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14002a1d0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov r14, r9
mov rsi, qword [rsp + 0x70]
mov dword [rsi], 1
xor edi, edi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
mov ecx, edi
lea r15, [0x140000000]
lea rbp, [0x140042670]
nop
movzx eax, byte [rcx + r15 + 0x31400]
mov byte [rcx + rbp], al
lea rcx, [rcx + 1]
test al, al
jne 0x14002a220
mov ecx, 0x10
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14002a27d
mov word [rax], di
mov qword [rax + 8], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x14002a280
inc eax
movsxd rcx, eax
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov qword [rbx + 8], rax
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x14002a280
mov rbx, rdi
mov edx, 1
mov rcx, rbx
call fcn.14002ab70
mov qword [rsi + 8], rax
test rax, rax
je 0x14002a305
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [r14], eax
cmp eax, 0xffffffff
je 0x14002a305
test rbx, rbx
je 0x14002a2c6
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002a2bd
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
mov rdx, rdi
nop dword [rax]
movzx eax, byte [rdx + r15 + 0x31430]
mov byte [rdx + rbp], al
lea rdx, [rdx + 1]
test al, al
jne 0x14002a2d0
mov rcx, rbp
call fcn.14002ae90
mov rbx, rax
mov edx, 0xa
mov rcx, rax
call fcn.14002ab70
mov qword [rsi + 0x10], rax
test rax, rax
jne 0x14002a30a
mov edi, 2
test rbx, rbx
je 0x14002a327
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002a31e
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
test edi, edi
je 0x14002a349
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14002a339
call fcn.14002a9e0
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14002a384
call fcn.14002a9e0
jmp 0x14002a384
lea rcx, [0x140029770]
mov rax, qword [rsp + 0x78]
mov qword [rax], rcx
lea rcx, [0x140029920]
mov qword [rax + 8], rcx
lea rcx, [0x140029d50]
mov qword [rax + 0x10], rcx
lea rcx, [0x140029a40]
mov qword [rax + 0x18], rcx
lea rcx, [0x140029aa0]
mov qword [rax + 0x20], rcx
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14002a640
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x48
xor esi, esi
mov r14, r8
movzx ebp, dx
mov rbx, rcx
test r8, r8
jne 0x14002a667
movzx eax, si
add rsp, 0x48
pop r14
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x40], r15
movzx edi, si
cmp si, bp
jge 0x14002a7b8
lea r15, [0x1400310a0]
mov r12d, 0xd
nop
mov rcx, qword [r14]
lea r9, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov r8d, 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002a6e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14002a6cb
mov eax, eax
mov ecx, dword [r15 + rax*4]
jmp 0x14002a6d0
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], sil
mov eax, dword [rsp + 0x88]
not byte [rsp + 0x80]
not byte [rsp + 0x81]
cmp ax, 2
jne 0x14002a800
movzx eax, word [rsp + 0x80]
cmp ax, r12w
jne 0x14002a7a4
mov word [rbx], r12w
mov rcx, qword [r14]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x80]
mov r8d, 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002a770
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14002a754
mov eax, eax
mov ecx, dword [r15 + rax*4]
jmp 0x14002a759
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], sil
mov eax, dword [rsp + 0x30]
not byte [rsp + 0x80]
not byte [rsp + 0x81]
cmp ax, 2
jne 0x14002a7e1
movzx eax, word [rsp + 0x80]
cmp ax, 0xa
je 0x14002a7d4
mov word [rbx + 2], ax
add rbx, 4
add di, 2
jmp 0x14002a7ab
mov word [rbx], ax
add rbx, 2
add di, 2
cmp di, bp
jl 0x14002a690
movzx eax, si
mov r12, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov r15, qword [rsp + 0x40]
add rsp, 0x48
pop r14
pop rsi
pop rbp
pop rbx
ret
mov eax, 0xa
mov dword [rbx + 2], eax
lea eax, [rdi + 4]
jmp 0x14002a7bb
test ax, ax
jne 0x14002a7bb
test di, di
je 0x14002a7bb
mov dword [rbx + 2], 0xa000d
mov eax, 0xa
mov word [rbx + 6], si
lea eax, [rdi + 4]
jmp 0x14002a7bb
test ax, ax
jne 0x14002a7bb
test di, di
je 0x14002a7bb
mov dword [rbx], 0xa000d
mov eax, 0xa
mov word [rbx + 4], si
lea eax, [rdi + 4]
jmp 0x14002a7bb

Function at 0x14002a820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
movsxd rdi, r8d
test r8d, r8d
jle 0x14002a84b
mov r9, rdi
nop dword [rax + rax]
not byte [rdx]
lea rdx, [rdx + 1]
dec r9
jne 0x14002a840
mov rcx, qword [rcx]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14002a89e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14002a882
lea rcx, [0x1400310a0]
mov eax, eax
mov ecx, dword [rcx + rax*4]
jmp 0x14002a887
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], 0
test rdi, rdi
jle 0x14002a8ae
not byte [rbx]
lea rbx, [rbx + 1]
dec rdi
jne 0x14002a8a3
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14002a8c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
movsxd rdi, r8d
lea r9, [rsp + 0x40]
mov r8d, edi
mov rbx, rdx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002a923
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14002a907
lea rcx, [0x1400310a0]
mov eax, eax
mov ecx, dword [rcx + rax*4]
jmp 0x14002a90c
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], 0
mov rcx, rdi
test edi, edi
jle 0x14002a93b
nop word [rax + rax]
not byte [rbx]
lea rbx, [rbx + 1]
dec rcx
jne 0x14002a930
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14002ab70
Capabilities:
Get common file path

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x360
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rbp, rcx
mov ecx, 0x10
mov r14d, edx
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov rdi, rax
test rax, rax
je 0x14002ac9d
mov qword [rsp + 0x390], rbx
xor ebx, ebx
mov qword [rsp + 0x398], rsi
mov qword [rax], rbx
mov qword [rax + 8], rbx
test rbp, rbp
je 0x14002abd3
mov rcx, rbp
call fcn.14002ae00
jmp 0x14002ac41
lea rdx, [rsp + 0x130]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14002ac6a
add eax, 0xc
cmp eax, 0x104
jae 0x14002ac6a
lea r9, [rsp + 0x20]
lea rdx, [0x1400314b8]
lea rcx, [rsp + 0x130]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x14002ac6a
nop dword [rax]
movzx eax, byte [rsp + rbx + 0x20]
lea rbx, [rbx + 1]
mov byte [rsp + rbx + 0x23f], al
test al, al
jne 0x14002ac20
lea rcx, [rsp + 0x240]
call fcn.14002ae90
mov edx, r14d
mov rcx, rax
mov qword [rdi + 8], rax
call fcn.14002aa60
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
jne 0x14002ac98
mov rcx, rdi
call fcn.14002a950
mov rcx, rdi
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
xor eax, eax
mov rbx, qword [rsp + 0x390]
mov rsi, qword [rsp + 0x398]
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.14002c960
add rsp, 0x360
pop r14
pop rdi
pop rbp
ret
mov rax, rdi
jmp 0x14002ac6c
mov dword [0x1400430b8], 2
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], 0
xor eax, eax
jmp 0x14002ac7c

Function at 0x14002ada0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14002adf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14002add8
lea rcx, [0x1400310a0]
mov eax, eax
mov ecx, dword [rcx + rax*4]
jmp 0x14002addd
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], 0
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x14002b2b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx], 0
mov rbx, rcx
je 0x14002b428
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
test ecx, ecx
jne 0x14002b420
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r14
or rcx, 0xffffffffffffffff
cmp byte [rbx + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14002b2f0
movzx eax, word [0x1400347c8]
xor r14d, r14d
cmp byte [rcx + rbx - 1], al
sete r14b
test r14d, r14d
je 0x14002b32b
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x14002b316
mov byte [rax + rbx - 1], 0
movzx eax, word [0x1400347c8]
movsx edx, al
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_strrchr]
or rbp, 0xffffffffffffffff
mov rdi, rax
nop
inc rbp
cmp byte [rbx + rbp], 0
jne 0x14002b340
mov rcx, rbx
add rbp, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14002b384
nop word [rax + rax]
movsx edx, byte [0x1400347c8]
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_strrchr]
mov rcx, rbx
mov byte [rax], 0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002b360
mov esi, 1
cmp rdi, rbp
je 0x14002b3e5
nop
test esi, esi
je 0x14002b404
movzx eax, byte [0x1400347c8]
xor edx, edx
mov rcx, rbx
mov byte [rdi], al
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14002b3bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14002b3bd
xor eax, eax
jmp 0x14002b3c2
mov eax, 1
and esi, eax
or rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14002b3d0
add rdi, rbx
cmp rdi, rbp
jne 0x14002b390
test esi, esi
je 0x14002b404
test r14d, r14d
je 0x14002b404
dec rbx
nop dword [rax]
cmp byte [rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x14002b3f0
movzx eax, word [0x1400347c8]
mov word [rbx], ax
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
mov eax, ecx
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14002b9f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x290
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, r8
mov rbx, rcx
xor r8d, r8d
lea rdx, str.Word_List__d
lea rcx, reloc.mfc120u.dll_Ordinal_296
call qword [sym.imp.USER32.dll_wsprintfA]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002baa8
mov dword [rsp + 0x30], 0x104
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.Name
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14002baaf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14002bb57
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.Enabled
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
test eax, eax
jne 0x14002baf3
mov eax, esi
cmp dword [rsp + 0x40], eax
setne al
mov dword [rdi], eax
jmp 0x14002baf9
mov dword [rdi], 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x10
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14002bb51
mov word [rax], si
mov qword [rax + 8], rsi
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x14002bb54
inc eax
movsxd rcx, eax
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov qword [rbx + 8], rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x14002bb54
mov rbx, rsi
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14002c960
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002bf0c
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x68]
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x50], rax
lea rax, [rsp + 0x38]
mov rdi, rcx
lea rdx, str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002c013
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov esi, 0x104
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002c004
cmp dword [rsp + 0x30], 2
mov byte [rbp + 0x43], bl
lea rcx, [rsp + 0x40]
jne 0x14002bfce
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
cmp eax, 0x103
setbe bl
jmp 0x14002c004
mov edx, ebx
sub rcx, rdi
lea rax, [rsi + 0x7ffffefa]
test rax, rax
je 0x14002bff0
mov al, byte [rcx + rdi]
test al, al
je 0x14002bff0
mov byte [rdi], al
inc rdi
dec rsi
jne 0x14002bfd3
test rsi, rsi
jne 0x14002bffd
dec rdi
mov edx, 0x8007007a
test edx, edx
mov byte [rdi], bl
setns bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14002c015
xor eax, eax
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.14002c960
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140025140
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x140009370]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x70]
add rcx, 0x20
call fcn.140025700
mov r8, rax
mov edx, 0x2712
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140065a50
lea rdx, [0x14000b1d0]
lea rcx, [rsp + 0x28]
call fcn.140025580
nop
lea rcx, [rsp + 0x28]
call fcn.140025700
mov r8, rax
mov edx, 0x2722
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140065a50
mov r8d, 5
mov edx, 0x44
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140065a50
mov r8d, 1
mov edx, 0x34
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140065a50
mov r8d, 1
mov edx, 0x63
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140065a50
xor r8d, r8d
mov edx, Ordinal_50
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140065a50
lea r8, [0x1400253c0]
mov edx, 0x4e2b
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140065a50
mov r8, qword [rsp + 0x70]
mov edx, 0x2711
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140065a50
xor r8d, r8d
mov edx, 0x40
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140065a50
xor r8d, r8d
mov edx, 0x51
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140065a50
nop
lea rcx, [rsp + 0x28]
call fcn.1400255e0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004ebb0
add rsp, 0x68
ret

Function at 0x140025420
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov r9, qword [rsp + 0x40]
mov r9, qword [r9 + 0x10]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.14004f7a4
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140028240
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x188
mov rax, qword [0x140009370]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdx, [0x14000bbdf]
mov rcx, qword [rsp + 0x198]
call fcn.1400361a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002828b
xor eax, eax
jmp 0x140028387
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x20]
call fcn.1400364d0
mov dword [rsp + 0x160], eax
cmp dword [rsp + 0x160], 0
je 0x1400282bf
mov rcx, qword [rsp + 0x20]
call fcn.140036550
xor eax, eax
jmp 0x140028387
lea r8, [rsp + 0x30]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x20]
call fcn.140036210
mov dword [rsp + 0x160], eax
cmp dword [rsp + 0x160], 0
je 0x1400282f5
mov rcx, qword [rsp + 0x20]
call fcn.140036550
xor eax, eax
jmp 0x140028387
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x164], eax
mov dword [rsp + 0x168], 0
jmp 0x14002831e
mov eax, dword [rsp + 0x168]
add eax, 1
mov dword [rsp + 0x168], eax
mov eax, dword [rsp + 0x164]
cmp dword [rsp + 0x168], eax
jge 0x14002836a
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x168]
mov rcx, qword [rsp + 0x20]
call fcn.140036210
mov dword [rsp + 0x160], eax
lea r8, [rsp + 0x34]
mov edx, dword [rsp + 0x168]
mov rcx, qword [rsp + 0x20]
call fcn.140036440
mov dword [rsp + 0x160], eax
jmp 0x14002830d
mov rcx, qword [rsp + 0x20]
call fcn.140036550
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14004ebb0
add rsp, 0x188
ret

Function at 0x1400283b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x24], 0
mov rcx, qword [rsp + 0x70]
call fcn.140028200
mov rcx, qword [rsp + 0x80]
call fcn.14004f860
mov dword [rsp + 0x34], eax
lea rdx, [0x14000bbe0]
mov rcx, qword [rsp + 0x70]
call fcn.14004f5fc
mov qword [rsp + 0x28], rax
lea rdx, [0x14000bbe4]
mov rcx, qword [rsp + 0x78]
call fcn.14004f5fc
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x28]
call fcn.140050288
test eax, eax
jne 0x14002849e
mov r9, qword [rsp + 0x28]
mov r8d, 1
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.140050268
mov rcx, qword [rsp + 0x28]
call fcn.140050288
test eax, eax
jne 0x140028499
mov eax, dword [rsp + 0x24]
cdq
idiv dword [rsp + 0x34]
movsxd rcx, edx
mov rax, qword [rsp + 0x80]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x20]
movsx ecx, byte [rsp + 0x30]
xor eax, ecx
mov byte [rsp + 0x20], al
mov r9, qword [rsp + 0x58]
mov r8d, 1
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.14004f7a4
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x24], eax
jmp 0x140028412
mov rcx, qword [rsp + 0x28]
call fcn.14004f3bc
mov rcx, qword [rsp + 0x58]
call fcn.14004f3bc
add rsp, 0x68
ret
Function at 0x1400295d0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x3b8
mov qword [rsp + 0x3a0], 0xfffffffffffffffe
mov rax, qword [0x140009370]
xor rax, rsp
mov qword [rsp + 0x3a8], rax
lea rcx, [rsp + 0x240]
call fcn.140027140
nop
mov dword [rsp + 0x248], 0
lea rdx, [rsp + 0x240]
lea rcx, [section..bss]
call fcn.1400287d0
lea rcx, [rsp + 0x240]
call fcn.1400271c0
lea rdx, [rsp + 0x250]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x390], rax
cmp qword [rsp + 0x390], 0xffffffffffffffff
je 0x1400296b3
mov eax, dword [rsp + 0x248]
add eax, 1
mov dword [rsp + 0x248], eax
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140029696
mov eax, dword [rsp + 0x248]
add eax, 1
mov dword [rsp + 0x248], eax
jmp 0x140029669
mov rcx, qword [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edx, edx
mov rcx, qword [rsp + 0x3c0]
call fcn.14002a6b0
mov eax, dword [rsp + 0x248]
mov dword [rsp + 0x398], eax
lea rcx, [rsp + 0x240]
call fcn.140027170
mov eax, dword [rsp + 0x398]
mov rcx, qword [rsp + 0x3a8]
xor rcx, rsp
call fcn.14004ebb0
add rsp, 0x3b8
ret