joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000dad0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140085020]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14000db0d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x14000db14
mov al, 1
jmp 0x14000dc81
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
call fcn.140006b00
mov word [rsp + 0x30], ax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
movzx edx, word [rsp + 0x30]
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x50]
call qword [0x1400642f0]
mov word [rsp + 0x32], ax
call fcn.140006b00
mov word [rsp + 0x34], ax
lea rdx, [rsp + 0x32]
lea rcx, [rsp + 0x34]
call fcn.140006b10
movzx eax, al
test eax, eax
je 0x14000db80
xor al, al
jmp 0x14000dc81
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.14000c250
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x14000dbef
cmp dword [rsp + 0x38], 1
je 0x14000dbfb
cmp dword [rsp + 0x38], 3
je 0x14000dc6f
jmp 0x14000dc7f
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x72], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x14000dc46
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x70]
call fcn.14002cdb0
cmp qword [rsp + 0x40], rax
je 0x14000dc46
xor al, al
jmp 0x14000dc81
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x14000dc60
mov dword [rsp + 0x3c], 1
jmp 0x14000dc68
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
jmp 0x14000dc81
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x72], 0
mov al, 1
jmp 0x14000dc81
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140011250
add rsp, 0xa8
ret
Function at 0x14000ea10
Capabilities:
Write file on windows

Disassembly:
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov rax, qword [0x140085020]
xor rax, rsp
mov qword [rsp + 0xb8], rax
call fcn.140006b00
mov word [rsp + 0x48], ax
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x48]
call fcn.140006b10
movzx eax, al
test eax, eax
je 0x14000ea68
lea rcx, [rsp + 0xd8]
call fcn.14000e9a0
jmp 0x14000ecd8
mov rcx, qword [rsp + 0xd0]
call fcn.14000b7f0
test rax, rax
je 0x14000ead7
mov rcx, qword [rsp + 0xd0]
call fcn.14000b7f0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0xd0]
call fcn.14000e860
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
jae 0x14000ead7
lea rcx, [rsp + 0xd8]
call fcn.14000f2a0
mov word [rsp + 0x4a], ax
mov rcx, qword [rsp + 0xd0]
call fcn.140006b30
movzx ecx, word [rsp + 0x4a]
mov word [rax], cx
movzx eax, word [rsp + 0xd8]
jmp 0x14000ecd8
mov rax, qword [rsp + 0xd0]
cmp qword [rax + 0x80], 0
jne 0x14000eaf3
call fcn.140006b00
jmp 0x14000ecd8
mov rcx, qword [rsp + 0xd0]
call fcn.14000e0d0
mov rax, qword [rsp + 0xd0]
cmp qword [rax + 0x68], 0
jne 0x14000eb6e
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 0x80]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0xd8]
call fcn.14000f2a0
mov word [rsp + 0x4c], ax
mov rdx, qword [rsp + 0x68]
movzx ecx, word [rsp + 0x4c]
call fcn.14000d300
movzx eax, al
test eax, eax
je 0x14000eb5a
movzx eax, word [rsp + 0xd8]
mov word [rsp + 0x44], ax
jmp 0x14000eb64
call fcn.140006b00
mov word [rsp + 0x44], ax
movzx eax, word [rsp + 0x44]
jmp 0x14000ecd8
mov qword [rsp + 0x88], 0x20
lea rcx, [rsp + 0xd8]
call fcn.14000f2a0
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xb0]
lea rcx, [rsp + 0x42]
mov rdx, qword [rsp + 0xd0]
add rdx, 0x74
lea r8, [rsp + 0x78]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, rcx
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call fcn.14000b280
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14000ec13
cmp dword [rsp + 0x50], 1
je 0x14000ec13
cmp dword [rsp + 0x50], 3
je 0x14000ec93
jmp 0x14000ecd3
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x14000ec67
mov rax, qword [rsp + 0xd0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x58]
mov edx, 1
lea rcx, [rsp + 0x90]
call fcn.14002cdb0
cmp qword [rsp + 0x58], rax
je 0x14000ec67
call fcn.140006b00
jmp 0x14000ecd8
mov rax, qword [rsp + 0xd0]
mov byte [rax + 0x72], 1
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x80], rax
je 0x14000ec8c
movzx eax, word [rsp + 0xd8]
jmp 0x14000ecd8
call fcn.140006b00
jmp 0x14000ecd8
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax + 0x80]
movzx ecx, word [rsp + 0x40]
call fcn.14000d300
movzx eax, al
test eax, eax
je 0x14000ecc2
movzx eax, word [rsp + 0xd8]
mov word [rsp + 0x46], ax
jmp 0x14000eccc
call fcn.140006b00
mov word [rsp + 0x46], ax
movzx eax, word [rsp + 0x46]
jmp 0x14000ecd8
call fcn.140006b00
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140011250
add rsp, 0xc8
ret
Function at 0x14001b900
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14001b3e0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14001b93f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1400642f0]
jmp 0x14001b949
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x14003ed10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140005bf0
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa20
mov rax, qword [0x14004a058]
xor rax, rsp
mov qword [rsp + 0xa10], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x9d8
mov bl, 1
call fcn.140014c80
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor edi, edi
cmp word [rsp + 0x30], di
jne 0x140005c4a
xor bl, bl
jmp 0x140005cb8
lea rcx, [rsp + 0x30]
sub rcx, 2
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x140005c53
movups xmm0, xmmword [str.Free_Download_Manager_5.lnk]
movzx eax, word [0x140034c90]
movups xmm1, xmmword [0x140034c68]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [0x140034c78]
movups xmmword [rcx + 0x10], xmm1
movsd xmm1, qword [0x140034c88]
movups xmmword [rcx + 0x20], xmm0
movsd qword [rcx + 0x30], xmm1
mov word [rcx + 0x38], ax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005cb8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
movzx ebx, bl
cmove ebx, edi
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x9d8
call fcn.140014c80
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp word [rsp + 0x30], di
jne 0x140005cf1
xor al, al
jmp 0x140005d6d
lea rcx, [rsp + 0x30]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x140005d00
movups xmm0, xmmword [str.Free_Download_Manager_5.lnk]
movzx eax, word [0x140034c90]
movups xmm1, xmmword [0x140034c68]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [0x140034c78]
movups xmmword [rcx + 0x10], xmm1
movsd xmm1, qword [0x140034c88]
movups xmmword [rcx + 0x20], xmm0
movsd qword [rcx + 0x30], xmm1
mov word [rcx + 0x38], ax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005d6a
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
movzx ecx, bl
cmove ecx, edi
movzx eax, cl
jmp 0x140005d6d
movzx eax, bl
mov rcx, qword [rsp + 0xa10]
xor rcx, rsp
call fcn.140012b20
mov rbx, qword [rsp + 0xa30]
add rsp, 0xa20
pop rdi
ret
Function at 0x140005d90
Capabilities:
Delete file
Get common file path

Disassembly:
sub rsp, 0xa68
mov rax, qword [0x14004a058]
xor rax, rsp
mov qword [rsp + 0xa50], rax
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x9d8
call fcn.140014c80
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp word [rsp + 0x70], 0
jne 0x140005df9
xor al, al
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.140012b20
add rsp, 0xa68
ret
lea rax, [rsp + 0x70]
sub rax, 2
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140005e02
mov ecx, dword [0x140034cd0]
xor edx, edx
movups xmm0, xmmword [str.Free_Download_Managerupdates]
mov qword [rsp + 0x30], rdx
movups xmm1, xmmword [0x140034ca8]
mov dword [rsp + 0x38], 3
movups xmmword [rax], xmm0
mov dword [rsp + 0x54], edx
movups xmm0, xmmword [0x140034cb8]
mov qword [rsp + 0x58], rdx
movups xmmword [rax + 0x10], xmm1
movsd xmm1, qword [0x140034cc8]
movups xmmword [rax + 0x20], xmm0
movsd qword [rax + 0x30], xmm1
mov dword [rax + 0x38], ecx
movzx ecx, word [0x140034cd4]
mov word [rax + 0x3c], cx
lea rax, [rsp + 0x70]
lea rcx, [0x1400348e8]
mov qword [rsp + 0x40], rax
mov eax, 0x414
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x30]
mov word [rsp + 0x50], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
setne al
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.140012b20
add rsp, 0xa68
ret
Function at 0x140005f10
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Move file

Disassembly:
push rbx
mov eax, 0x4e70
call fcn.140012ac0
sub rsp, rax
mov rax, qword [0x14004a058]
xor rax, rsp
mov qword [rsp + 0x4e60], rax
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x140005fea
cmp qword [rcx + 0x18], 8
jb 0x140005f49
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140006043
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x140005f65
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140006043
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400103a0
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
mov rcx, rbx
cmovae rdx, qword [rsp + 0x20]
cmp qword [rbx + 0x18], 8
jb 0x140005f9e
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140006005
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140005fea
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fe5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000608d
call fcn.1400124f4
xor al, al
mov rcx, qword [rsp + 0x4e60]
xor rcx, rsp
call fcn.140012b20
add rsp, 0x4e70
pop rbx
ret
mov rax, qword [rsp + 0x38]
cmp rax, 8
jb 0x140006043
mov rcx, qword [rsp + 0x20]
lea rdx, [rax*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000603e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000608d
call fcn.1400124f4
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x4e20
call fcn.140014c80
mov r8d, 0x2710
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp qword [rbx + 0x18], 8
jb 0x140006072
mov rbx, qword [rbx]
xor r8d, r8d
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
jmp 0x140005fec
call fcn.1400190b8
int3
Function at 0x14000c380
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x90], 0
mov rdi, rcx
mov sil, 1
jne 0x14000c456
mov rax, qword [rcx + 0x68]
sub rax, qword [rcx + 0x60]
mov qword [rsp + 0x30], r14
xor r14d, r14d
sar rax, 5
sub eax, 1
movsxd rbp, eax
js 0x14000c401
mov rbx, rbp
shl rbx, 5
nop word [rax + rax]
mov rcx, qword [rdi + 0x60]
add rcx, rbx
cmp qword [rcx + 0x18], 8
jb 0x14000c3e1
mov rcx, qword [rcx]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
movzx esi, sil
cmove esi, r14d
sub rbx, 0x20
sub rbp, 1
jns 0x14000c3d0
mov rax, qword [rdi + 0x80]
sub rax, qword [rdi + 0x78]
sar rax, 5
sub eax, 1
movsxd rbp, eax
js 0x14000c451
mov rbx, rbp
shl rbx, 5
nop
mov rcx, qword [rdi + 0x78]
add rcx, rbx
cmp qword [rcx + 0x18], 8
jb 0x14000c431
mov rcx, qword [rcx]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
movzx esi, sil
cmove esi, r14d
sub rbx, 0x20
sub rbp, 1
jns 0x14000c420
mov r14, qword [rsp + 0x30]
mov rbp, qword [rdi + 0x68]
mov rbx, qword [rdi + 0x60]
cmp rbx, rbp
je 0x14000c478
mov rcx, rbx
call fcn.140004be0
add rbx, 0x20
cmp rbx, rbp
jne 0x14000c463
mov rbx, qword [rdi + 0x60]
mov qword [rdi + 0x68], rbx
mov rbp, qword [rdi + 0x80]
mov rbx, qword [rdi + 0x78]
cmp rbx, rbp
je 0x14000c4ae
nop dword [rax]
mov rcx, rbx
call fcn.140004be0
add rbx, 0x20
cmp rbx, rbp
jne 0x14000c490
mov rcx, qword [rdi + 0x78]
mov qword [rdi + 0x80], rcx
jmp 0x14000c4b5
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x38]
movzx eax, sil
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c4d0
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [rcx + 0x68]
xor r13d, r13d
sub r14, qword [rcx + 0x60]
mov rsi, rcx
sar r14, 5
sub r14d, 1
js 0x14000c59d
movsxd r15, r14d
shl r15, 5
mov r12, r15
mov rcx, qword [rsi + 0x60]
add rcx, r15
cmp qword [rcx + 0x18], 8
jb 0x14000c523
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000c58b
mov rdi, qword [rsi + 0x60]
mov rbp, qword [rsi + 0x68]
add rdi, r12
lea rbx, [rdi + 0x20]
cmp rbx, rbp
je 0x14000c57d
cmp rdi, rbx
je 0x14000c56c
mov rcx, rdi
call fcn.140004be0
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
add rdi, 0x20
add rbx, 0x20
cmp rbx, rbp
jne 0x14000c541
mov rbp, qword [rsi + 0x68]
lea rcx, [rbp - 0x20]
call fcn.140004be0
add qword [rsi + 0x68], 0xffffffffffffffe0
sub r12, 0x20
sub r15, 0x20
sub r14d, 1
jns 0x14000c512
mov r14, qword [rsi + 0x80]
sub r14, qword [rsi + 0x78]
sar r14, 5
sub r14d, 1
js 0x14000c654
movsxd r15, r14d
shl r15, 5
mov r12, r15
mov rcx, qword [rsi + 0x78]
add rcx, r15
cmp qword [rcx + 0x18], 8
jb 0x14000c5d1
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x14000c642
mov rdi, qword [rsi + 0x78]
mov rbp, qword [rsi + 0x80]
add rdi, r12
lea rbx, [rdi + 0x20]
cmp rbx, rbp
je 0x14000c631
cmp rdi, rbx
je 0x14000c61d
mov rcx, rdi
call fcn.140004be0
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
add rdi, 0x20
add rbx, 0x20
cmp rbx, rbp
jne 0x14000c5f2
mov rbp, qword [rsi + 0x80]
lea rcx, [rbp - 0x20]
call fcn.140004be0
add qword [rsi + 0x80], 0xffffffffffffffe0
sub r12, 0x20
sub r15, 0x20
sub r14d, 1
jns 0x14000c5c0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000c680
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14004a058]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov r15, qword [rcx + 0x68]
sub r15, qword [rcx + 0x60]
sar r15, 5
sub r15d, 1
js 0x14000c8ec
movsxd r12, r15d
shl r12, 5
movabs rbp, 0x7ffffffffffffffe
nop word [rax + rax]
movsxd rbx, r15d
shl rbx, 5
mov rcx, qword [rdi + 0x60]
add rcx, rbx
call fcn.140010920
test al, al
jne 0x14000c89f
mov rdx, qword [rdi + 0x60]
add rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400103a0
nop
cmp qword [rsp + 0x38], 0
je 0x14000c8ae
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
mov rcx, qword [rdi + 0x60]
add rcx, r12
cmp qword [rcx + 0x18], 8
jb 0x14000c73b
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14000c861
mov rdi, qword [rdi + 0x60]
add rdi, r12
lea rax, [rsp + 0x28]
cmp rdi, rax
je 0x14000c85c
mov r14, qword [rsp + 0x38]
lea r13, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r13, qword [rsp + 0x28]
mov rsi, qword [rdi + 0x18]
cmp r14, rsi
ja 0x14000c7aa
mov rbp, rdi
cmp rsi, 8
jb 0x14000c789
mov rbp, qword [rdi]
mov qword [rdi + 0x10], r14
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r13
mov rcx, rbp
call fcn.1400145d0
xor eax, eax
mov word [rbx + rbp], ax
jmp 0x14000c852
cmp r14, rbp
ja 0x14000c923
mov rbx, r14
or rbx, 7
cmp rbx, rbp
jbe 0x14000c7c4
mov rbx, rbp
jmp 0x14000c7e5
mov rcx, rsi
shr rcx, 1
mov rax, rbp
sub rax, rcx
cmp rsi, rax
jbe 0x14000c7da
mov rbx, rbp
jmp 0x14000c7e5
lea rax, [rcx + rsi]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
mov rcx, rdi
call fcn.140004c70
mov rbp, rax
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r13
mov rcx, rax
call fcn.1400145d0
xor eax, eax
mov word [rbx + rbp], ax
cmp rsi, 8
jb 0x14000c84f
mov rcx, qword [rdi]
lea rdx, [rsi*2 + 2]
cmp rdx, 0x1000
jb 0x14000c84a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c91d
mov rcx, r8
call fcn.1400124f4
mov qword [rdi], rbp
movabs rbp, 0x7ffffffffffffffe
mov rdi, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000c89f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c89a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c917
call fcn.1400124f4
sub r12, 0x20
sub r15d, 1
js 0x14000c8ec
jmp 0x14000c6e0
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000c8ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c8e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c917
call fcn.1400124f4
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140012b20
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400190b8
nop
call fcn.1400190b8
nop
call fcn.140004c50
int3
Function at 0x14000ce20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
mov eax, 0x4e70
call fcn.140012ac0
sub rsp, rax
mov rax, qword [0x14004a058]
xor rax, rsp
mov qword [rsp + 0x4e60], rax
mov qword [rsp + 0x38], rdx
mov rbx, rdx
mov r9d, dword [rcx + 0x48]
lea rdx, [rcx + 0x28]
or r9d, 0x20019
cmp qword [rdx + 0x18], 8
jb 0x14000ce62
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x20]
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000ce96
xor ecx, ecx
mov qword [rbx + 0x18], 7
mov qword [rbx], rcx
mov qword [rbx + 0x10], rcx
mov word [rbx], cx
jmp 0x14000cf5b
xor edx, edx
mov dword [rsp + 0x30], 0x4e20
mov r8d, 0x4e20
lea rcx, [rsp + 0x40]
call fcn.140014c80
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.Inno_Setup:_App_Path
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov rax, r8
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000cef6
xor ecx, ecx
test rax, rax
je 0x14000cf2d
movzx edx, word [rsp + rax*2 + 0x3e]
cmp dx, 0x5c
je 0x14000cf18
cmp dx, 0x2f
jne 0x14000cf2d
lea rax, [rax*2 - 2]
cmp rax, 0x4e20
jae 0x14000cf77
mov word [rsp + rax + 0x40], cx
mov qword [rbx], rcx
lea rax, [rsp + 0x40]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 7
mov word [rbx], cx
inc r8
cmp word [rax + r8*2], cx
jne 0x14000cf44
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140004ed0
mov rax, rbx
mov rcx, qword [rsp + 0x4e60]
xor rcx, rsp
call fcn.140012b20
add rsp, 0x4e70
pop rbx
ret
call fcn.140012c7c
int3

Function at 0x14000cf80
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x40], 8
lea rdx, [rcx + 0x28]
jb 0x14000cf92
mov rdx, qword [rdx]
mov r8d, dword [rcx + 0x48]
xor r9d, r9d
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
sete al
add rsp, 0x28
ret

Function at 0x14000d2c0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rax, vtable.vmsWinOsVersion.0
mov qword [rcx], rax
xor edx, edx
mov r8d, 0x11c
add rcx, 8
call fcn.140014c80
mov dword [rbx + 8], 0x11c
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbx + 8]
test rax, rax
je 0x14000d323
call rax
test eax, eax
sete al
jmp 0x14000d32e
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
setne al
test al, al
je 0x14000d34a
cmp dword [rbx + 0xc], 0xa
jne 0x14000d351
cmp dword [rbx + 0x14], 0x55f0
jb 0x14000d351
mov dword [rbx + 0xc], 0xb
jmp 0x14000d351
mov dword [rbx + 0xc], 0
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000dfe0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x168
mov rax, qword [0x14004a058]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rax, vtable.vmsWinOsVersion.0
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0x11c
lea rcx, [rsp + 0x28]
call fcn.140014c80
mov dword [rsp + 0x28], 0x11c
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x28]
test rax, rax
je 0x14000e04f
call rax
test eax, eax
sete al
jmp 0x14000e05a
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
setne al
test al, al
je 0x14000e078
mov eax, dword [rsp + 0x2c]
cmp eax, 0xa
jne 0x14000e07a
cmp dword [rsp + 0x34], 0x55f0
jb 0x14000e07a
mov eax, 0xb
jmp 0x14000e07a
xor eax, eax
cmp eax, 6
setae al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140012b20
add rsp, 0x168
ret
Function at 0x1400295bc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400295ec
xor eax, eax
jmp 0x1400296af
mov rbp, rbx
cmp word [rax], si
je 0x140029611
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400295f8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400295f4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140027edc
movsxd r14, eax
test eax, eax
jne 0x14002964f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400295e5
mov rcx, r14
call fcn.140023ffc
mov rdi, rax
test rax, rax
jne 0x140029668
xor ecx, ecx
call fcn.140023c30
jmp 0x140029644
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140027edc
test eax, eax
jne 0x140029699
mov rcx, rdi
call fcn.140023c30
jmp 0x1400296a3
xor ecx, ecx
call fcn.140023c30
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret