joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400061e0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x4e70
call fcn.140031790
sub rsp, rax
mov rax, qword [0x14005f148]
xor rax, rsp
mov qword [rsp + 0x4e60], rax
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x3e80
call sub.VCRUNTIME140.dll_memset
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
mov r8d, 0x3e80
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x1400062f6
lea rax, [rsp + 0x3ec0]
mov dword [rsp + 0x2c], ebx
mov qword [rsp + 0x30], rax
mov edi, 0xfa0
mov eax, dword [rsp + 0x20]
mov word [rsp + 0x2a], di
test rax, 0xfffffffffffffff8
jbe 0x1400062ef
nop
mov r8, rdi
lea rcx, [rsp + 0x3ec0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + rbx*8 + 0x40]
lea rdx, [rsp + 0x3ec0]
mov r8d, 0x7cf
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x3ec0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400062b0
mov r8, qword [rsp + rbx*8 + 0x40]
lea rdx, [rsp + 0x28]
add ax, ax
lea rcx, [0x14005f1d0]
xor r9d, r9d
mov word [rsp + 0x28], ax
call fcn.140006320
test eax, eax
je 0x1400062f6
mov eax, dword [rsp + 0x20]
inc rbx
shr rax, 3
cmp rbx, rax
jb 0x140006270
mov eax, 1
jmp 0x1400062f8
xor eax, eax
mov rcx, qword [rsp + 0x4e60]
xor rcx, rsp
call fcn.140031320
mov rbx, qword [rsp + 0x4e80]
add rsp, 0x4e70
pop rdi
ret
Function at 0x140006fe0
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x1400071ba
push rdi
sub rsp, 0x60
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, DispGetParam
lea r8, [rsp + 0x30]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.PSAPI.DLL_GetModuleInformation]
test eax, eax
je 0x1400071b5
mov eax, 0x5a4d
mov qword [rsp + 0x50], r15
mov r15d, dword [rsp + 0x38]
cmp word [rdi], ax
jne 0x1400071b0
movsxd rcx, dword [rdi + 0x3c]
lea rax, [rcx + 0x108]
cmp rax, r15
jae 0x1400071b0
cmp dword [rcx + rdi], 0x4550
mov qword [rsp + 0x80], rbp
lea rbp, [rcx + rdi]
jne 0x1400071a8
movzx eax, word [rbp + 4]
mov ecx, 0x14c
mov qword [rsp + 0x88], rsi
xor esi, esi
mov qword [rsp + 0x58], r14
cmp cx, ax
jne 0x14000708c
xor r14d, r14d
jmp 0x1400070be
mov ecx, 0x200
mov r8d, 0xaa64
cmp cx, ax
je 0x1400070b0
mov ecx, 0x8664
cmp cx, ax
je 0x1400070b0
cmp r8w, ax
jne 0x14000719b
cmp r8w, ax
mov r14d, 1
sete sil
mov qword [rsp + 0x78], rbx
mov ebx, dword [rbp + 0x28]
add rbx, rdi
je 0x140007196
cmp rbx, rdi
jbe 0x140007196
lea rax, [r15 + rdi]
cmp rbx, rax
jae 0x140007196
mov rcx, rbx
call fcn.140007ba0
test eax, eax
je 0x140007196
mov r9d, r14d
mov dword [rsp + 0x20], esi
mov r8d, r15d
mov rdx, rdi
mov rcx, rbp
call fcn.140007c10
mov edx, reloc.OLEAUT32.dll_SafeArrayLock
mov dword [rsp + 0x70], 0
lea r9, [rsp + 0x70]
mov rcx, rbx
lea r8d, [rdx + 0x2c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140007196
test r14d, r14d
jne 0x140007146
mov eax, dword [0x14005f1c0]
mov dword [rbx], eax
movzx eax, byte [0x14005f1c4]
mov byte [rbx + 4], al
jmp 0x14000716a
test esi, esi
je 0x140007156
mov rax, qword [0x14005f1b8]
mov qword [rbx], rax
jmp 0x14000716a
movzx eax, word [0x14005f1b4]
mov word [rbx], ax
movzx eax, byte [0x14005f1b6]
mov byte [rbx + 2], al
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x70]
mov edx, reloc.OLEAUT32.dll_SafeArrayLock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x80]
mov r15, qword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
Function at 0x14000ad40
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14005f148]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp qword [rcx + 0x38], 0
mov rbx, rcx
je 0x14000ad9d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000adc4
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14000ad9d
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xor edi, edi
mov qword [rbx + 0x38], rdi
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140031320
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor edi, edi
test eax, eax
je 0x14000ae30
mov rcx, qword [rbx + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rax
test rcx, rcx
je 0x14000ae5c
mov rax, qword [rcx]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test eax, eax
je 0x14000ae30
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000adf2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14000ae52
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rdi
mov eax, 1
jmp 0x14000ad9f
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
Function at 0x1400148f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x1400149a9
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x140014975
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14001498d
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14001498d
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call qword [case.0x140023e68.0]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x14001498d
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp byte [0x1400691c8], 0
jne 0x1400149f4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400149e4
lea rdx, [0x140038710]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400691c0], rax
mov byte [0x1400691c8], 1
jmp 0x1400149fb
mov rax, qword [0x1400691c0]
mov byte [0x1400691c8], 1
jmp 0x1400149fb
mov rax, qword [0x1400691c0]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14001497e
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [case.0x140023e68.0]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
push 0xffffffffffffff96
sub byte [rcx + rax*8 - 0x2c], 0x83
invalid
or dword [rsi + 0x68], 0x32
or dword [rcx + 0x26], ebx
mov dword [rbp - 0x276322b7], ebx
invalid
Function at 0x1400158d0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14005f148]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov qword [rsp + 0x40], rbp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x50], rbp
lea rcx, [rsp + 0x40]
call fcn.140015390
mov ebx, eax
test eax, eax
jne 0x1400159e7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x58], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400159c1
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.1400158d0
mov ebx, eax
test eax, eax
jne 0x1400159e7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x58], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140015970
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400159d6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov dword [rsp + 0x48], ebp
mov rcx, rdi
call fcn.1400148f0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400159f7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140031320
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015f10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x14005f148]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140015fa7
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140015fa7
call fcn.140014540
mov ebx, eax
jmp 0x1400160cc
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140015fc8
call fcn.140014540
jmp 0x1400160bb
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140015feb
call fcn.140014540
jmp 0x1400160bb
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14001600d
mov ebx, 0x8007000e
jmp 0x1400160bd
mov ecx, eax
test eax, eax
je 0x140016042
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140016104
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140016042
lea rcx, [rsp + 0x60]
call fcn.140014390
jmp 0x14001604c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x14001605f
cmp qword [rsp + 0x60], 0
jne 0x14001606e
mov ebx, 0x8007000e
jmp 0x1400160bd
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140016098
call fcn.140014540
jmp 0x1400160bb
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140015a20
mov ebx, eax
test rdi, rdi
je 0x1400160cc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x1400160e3
lea rcx, [rsp + 0x60]
call fcn.140014a30
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140031320
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140014570
int3
Function at 0x140020910
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x14005f148]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea r8, [0x1400408c8]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t____cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t_____ptr64____ptr64]
lea rcx, [rsp + 0x20]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400209d4
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov rcx, rax
xor edx, edx
call fcn.14000a200
test eax, eax
je 0x1400209d4
mov ebx, 1
jmp 0x1400209d6
xor ebx, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140031320
add rsp, 0x290
pop rbx
ret
Function at 0x140021280
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x480
mov rax, qword [0x14005f148]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor ebx, ebx
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsOUTLOOK.EXE
mov r9d, 0x2001f
mov qword [rsp + 0x38], rbx
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rbx
call fcn.140015390
test eax, eax
jne 0x140021362
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x410
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4c]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], 0x410
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140044210]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140021362
mov eax, dword [rsp + 0x4c]
dec eax
cmp eax, 1
ja 0x140021362
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x140021341
test al, 1
jne 0x140021362
shr rax, 1
cmp word [rsp + rax*2 + 0x5e], bx
je 0x140021346
jmp 0x140021362
mov word [rsp + 0x60], bx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x140021362
cmp dword [rsp + 0x50], 6
sete bl
cmp qword [rsp + 0x30], 0
je 0x140021375
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140031320
add rsp, 0x480
pop rbx
ret
Function at 0x140021e90
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x14005f148]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea r8, [0x1400408c8]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t____cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t_____ptr64____ptr64]
lea rcx, [rsp + 0x20]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140021f67
mov rcx, rdi
call fcn.140020910
test eax, eax
je 0x140021f67
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov rdx, rax
mov ebx, 1
mov r8d, ebx
mov rcx, rdi
call fcn.140021570
jmp 0x140021f69
xor ebx, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140031320
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret
Function at 0x140022020
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x14005f148]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rdx, [rbp + 0x27]
call fcn.14001fd40
nop
lea rcx, [rbp + 0x27]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
test eax, eax
je 0x14002205f
xor ebx, ebx
jmp 0x14002214d
lea rdx, [0x140044210]
lea rcx, [rbp - 1]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x27]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov r8, rax
lea rdx, [0x140040ae8]
lea rcx, [rbp - 1]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::Format_wchar_t_const____ptr64____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
mov dword [rbp - 0x79], 0x70
mov dword [rbp - 0x75], 0x240
xor ebx, ebx
mov qword [rbp - 0x71], rbx
lea rax, str.open
mov qword [rbp - 0x69], rax
lea rax, str.msiexec.exe
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x51], rbx
mov dword [rbp - 0x49], 5
mov qword [rbp - 0x41], rbx
lea rcx, [rbp - 1]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov qword [rbp - 0x59], rax
lea rcx, [rbp - 0x79]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rcx, qword [rbp - 0x11]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140022142
mov dword [rbp - 9], ebx
mov edx, 0x927c0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 9]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp - 0x11]
cmp rcx, 0xffffffffffffffff
je 0x14002213d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x11], rbx
mov ebx, 1
lea rcx, [rbp - 1]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x27]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140031320
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rbp
ret
Function at 0x1400242d0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14005f148]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call fcn.14001ddd0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.14001de10
cmp qword [rsp + 0x20], 0
jne 0x14002430f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x20]
call fcn.1400242c0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
mov rcx, rdx
call qword [case.0x140023e68.0]
call fcn.14001ddd0
mov rcx, rax
call fcn.14001cc50
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140028fa0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rdi
push r15
sub rsp, 0x68
mov rax, qword [0x14005f148]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rdi, [rcx + 0x178]
mov r15, rdx
mov rcx, rdi
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
test eax, eax
jne 0x140029118
mov rcx, rdi
mov qword [rsp + 0x58], rsi
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rcx, rax
mov dword [rsp + 0x28], 0x10000000
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140029113
mov qword [rsp + 0x90], rbx
xor edx, edx
mov qword [rsp + 0x60], rbp
mov rcx, rax
mov qword [rsp + 0x50], r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
test eax, eax
je 0x1400290f8
mov edx, ebp
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x1400290f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
test rax, rax
jne 0x140029084
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140029101
xor eax, eax
lea r9, [rsp + 0x40]
mov rdi, rdx
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov r8d, ebp
rep stosb byte [rdi], al
mov rcx, rsi
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
test eax, eax
jne 0x1400290c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140029101
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r8, r15
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x140029101
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140029101
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140031320
add rsp, 0x68
pop r15
pop rdi
ret