joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c560
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x190
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rcx
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerNew_Windows
xor ebp, ebp
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x50], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x14007c7b1
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.PopupMgr
xor r8d, r8d
mov dword [rsp + 0x58], 0xa
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14007c7a6
cmp dword [rsp + 0x48], 1
jne 0x14007c7a6
lea rdx, [rsp + 0x60]
lea rcx, [0x1400e4ef8]
call fcn.1400c1f80
test eax, eax
jne 0x14007c7a6
lea rdx, [0x1400f4794]
mov rcx, rdi
mov qword [rsp + 0x1a8], rbx
call fcn.1400c38d0
test rax, rax
mov rbx, rax
jne 0x14007c638
mov rbx, rdi
jmp 0x14007c63c
add rbx, 3
test rbx, rbx
je 0x14007c79e
mov edx, 0x2f
mov rcx, rbx
mov qword [rsp + 0x1b0], rsi
call fcn.1400c7e50
test rax, rax
mov rdi, rax
je 0x14007c685
sub rdi, rbx
lea rcx, [rdi + 1]
call fcn.1400c7310
mov r8, rdi
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call fcn.1400c9a80
mov byte [rdi + rsi], bpl
jmp 0x14007c6b0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
call fcn.1400c7310
mov rcx, rax
mov rsi, rax
sub rcx, rbx
movzx eax, byte [rbx]
add rbx, 1
test al, al
mov byte [rcx + rbx - 1], al
jne 0x14007c6a1
test rsi, rsi
je 0x14007c796
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x40]
lea rdx, str.Allow
mov qword [rsp + 0x40], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x14007c78e
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov edi, ebp
mov dword [rsp + 0x4c], 0x104
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x14007c763
nop
nop
nop
lea rcx, [rsp + 0x70]
mov rdx, rsi
add edi, 1
call fcn.1400c9df0
test eax, eax
je 0x14007c783
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x70]
mov edx, edi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x14007c720
mov rcx, qword [rsp + 0x40]
mov r9d, 3
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.14002d0b0
mov rsi, qword [rsp + 0x1b0]
mov rbx, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400c2a20
mov rbp, qword [rsp + 0x1b8]
add rsp, 0x190
pop rdi
ret
Function at 0x14007c7e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword [str.robohelp_csh.htm]
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [0x1400fb678]
mov esi, edx
mov qword [rcx + 8], rax
movzx eax, byte [0x1400fb680]
lea rdx, [rsp + 0x40]
mov byte [rcx + 0x10], al
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test rbx, rbx
je 0x14007c8ba
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x20]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea eax, [rdx + rcx]
cmp eax, esi
jae 0x14007c8ba
lea rax, [rsp + 0x40]
mov rdx, rbx
lea rcx, [rsp + 0x40]
sub rdx, rax
nop
nop
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rdx + rcx - 1], al
jne 0x14007c880
xor eax, eax
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.robohelp_csh.htm]
mov qword [rdi - 1], rax
mov rax, qword [0x1400fb678]
mov qword [rdi + 7], rax
movzx eax, byte [0x1400fb680]
mov byte [rdi + 0xf], al
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x20]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea eax, [rdx + rcx]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400c2a20
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14007c910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2e0
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rbx, rdx
mov rsi, rcx
mov edx, r8d
mov rcx, rbx
mov edi, r8d
call fcn.14007c7e0
cmp eax, edi
mov ebp, eax
ja 0x14007caa3
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x310], r12
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea rcx, [rsp + 0x50]
lea rdx, str._html__r_n_script_language_Javascript___r_n_____r_ndocument.location__s___r_n______r_n__script__r_n__html_
mov r8d, 0x61
mov r12, rax
call fcn.1400c1a10
cmp r12, 0xffffffffffffffff
je 0x14007ca99
lea rdx, [0x1400f4794]
mov rcx, rsi
call fcn.1400c38d0
test rax, rax
jne 0x14007ca28
lea edx, [rax + 0x5c]
mov rcx, rsi
call fcn.1400c7e50
test rax, rax
je 0x14007c9e5
nop
mov edx, 0x5c
mov rcx, rax
mov byte [rax], 0x2f
call fcn.1400c7e50
test rax, rax
jne 0x14007c9d0
movabs rax, 0x2f2f3a656c6966
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xc0]
mov qword [rsp + 0xc0], rax
xor eax, eax
repne scasb al, byte [rdi]
xor edx, edx
nop
nop
movzx eax, byte [rsi + rdx]
add rdx, 1
test al, al
mov byte [rdi + rdx - 2], al
jne 0x14007ca10
lea rsi, [rsp + 0xc0]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
mov rdi, rsi
mov dword [rsp + 0x40], eax
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea edi, [rdx + rcx - 3]
lea ecx, [rdi + 1]
call fcn.1400c7310
lea rdx, [rsp + 0x50]
mov r8, rsi
mov rcx, rax
mov rbx, rax
call fcn.1400c2cf0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rbx
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14002d0b0
mov r12, qword [rsp + 0x310]
mov eax, ebp
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1400c2a20
mov rbx, qword [rsp + 0x318]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140084b90
Capabilities:
Check mutex on windows
Check os version

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
cmp qword [rcx + 0x50], rbx
jne 0x140084c9c
mov byte [rsp + 0x70], bl
xor eax, eax
mov qword [r11 - 0x57], rax
mov qword [r11 - 0x4f], rax
mov qword [r11 - 0x47], rax
mov qword [r11 - 0x3f], rax
mov qword [r11 - 0x37], rax
mov qword [r11 - 0x2f], rax
mov qword [r11 - 0x27], rax
mov dword [r11 - 0x1f], eax
mov word [r11 - 0x1b], ax
mov byte [r11 - 0x19], al
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x140084c2d
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x140084c2d
lea r8, str.sepbfclizmoveps
lea rdx, str.Global_s
lea rcx, [rsp + 0x70]
call fcn.1400c2cf0
jmp 0x140084c47
lea rcx, [rsp + 0x70]
mov rax, qword [str.sepbfclizmoveps]
mov qword [rcx], rax
mov rax, qword [0x1400fc178]
mov qword [rcx + 8], rax
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov edx, 1
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea r8, [rsp + 0x70]
xor edx, edx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rdi + 0x50], rax
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x140084cd1
mov edx, 0x493e0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
test eax, eax
sete bl
mov dword [rsp + 0x20], ebx
test ebx, ebx
jne 0x140084cd1
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x50], 0
mov eax, ebx
jmp 0x140084cd9
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400c2a20
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rdi
ret
Function at 0x140086ae0
Capabilities:
Create directory
Get common file path

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x290
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x2c0], rbx
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r12, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov rdi, rbx
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x60], bl
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x61]
call fcn.1400c2840
nop
mov byte [rsp + 0x170], bl
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x171]
call fcn.1400c2840
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ecx, ecx
call fcn.1400c2a40
mov r8, rax
lea rdx, [0x1400f04ac]
lea rcx, [rsp + 0x170]
call fcn.1400c2cf0
mov r8d, 0x103
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x60]
call fcn.1400c9130
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rsp + 0x60]
call fcn.1400b3780
test eax, eax
je 0x140086c35
mov ecx, 0x170
call fcn.14008c4a0
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140086bf4
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r9, [0x1400fc934]
lea r8, [0x1400fc930]
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140016060
mov rdi, rax
jmp 0x140086bf7
mov rdi, rbx
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140085e00
test eax, eax
sete bl
mov dword [rsp + 0x40], ebx
jmp 0x140086c40
test rdi, rdi
je 0x140086c55
mov rcx, rdi
call fcn.1400166f0
mov rcx, rdi
call fcn.14008c4f0
cmp byte [rsp + 0x60], 0
je 0x140086c75
lea rcx, [rsp + 0x60]
call fcn.1400b3780
test eax, eax
je 0x140086c75
lea rcx, [rsp + 0x60]
call fcn.1400b6690
nop
mov eax, ebx
jmp 0x140086c7d
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400c2a20
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop r12
pop rdi
pop rsi
ret
Function at 0x1400874c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, rdx
mov r14, rcx
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
mov qword [rsp + 0xc8], rax
cmp rax, 0xffffffffffffffff
je 0x1400876c8
mov dword [rsp + 0x50], r15d
lea rcx, [r14 + 8]
call fcn.1400389c0
nop
lea rcx, [r14 + 8]
call fcn.140039050
mov rdi, rax
nop
test rdi, rdi
je 0x14008756e
mov rcx, rdi
call fcn.140038640
test rax, rax
je 0x14008755d
cmp byte [rax + 0x30], 0
je 0x14008755d
add dword [rsp + 0x50], 1
mov rdx, rdi
lea rcx, [r14 + 8]
call fcn.140039060
mov rdi, rax
jmp 0x140087540
jmp 0x140087583
lea rcx, [r14 + 8]
call fcn.140038a10
mov dword [rsp + 0x48], 0xa528b384
mov dword [rsp + 0x4c], 1
lea rcx, [r14 + 8]
call fcn.140039650
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xc0]
mov r8d, 0xc
lea rdx, [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [r14 + 8]
call fcn.1400389c0
nop
lea rcx, [r14 + 8]
call fcn.140039050
mov rbx, rax
test rbx, rbx
je 0x1400876a3
mov rcx, rbx
call fcn.140038640
mov rsi, rax
test rax, rax
je 0x14008768f
cmp byte [rax + 0x30], 0
je 0x14008768f
mov dword [rsp + 0x58], 0x713e9882
mov ecx, dword [rax + 0x10]
mov dword [rsp + 0x5c], ecx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, qword [rsi + 8]
repne scasb al, byte [rdi]
not rcx
mov dword [rsp + 0x60], ecx
mov eax, dword [rsi + 0x2c]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xc0]
mov r8d, 0x10
lea rdx, [rsp + 0x58]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xc0]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsi + 8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xc0]
mov r8d, dword [rsp + 0x64]
mov rdx, qword [rsi + 0x18]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, rbx
lea rcx, [r14 + 8]
call fcn.140039060
mov rbx, rax
jmp 0x1400875e0
jmp 0x1400876b5
lea rcx, [r14 + 8]
call fcn.140038a10
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140087a20
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rbx, rdx
mov r12, rcx
call fcn.140087400
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140087c1d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0xa0]
mov r8d, 0xc
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0xa0], 0xc
jne 0x140087c13
cmp dword [rsp + 0x48], 0xa528b384
jne 0x140087c13
cmp dword [rsp + 0x4c], 1
jne 0x140087c13
mov eax, dword [rsp + 0x50]
nop
nop
test eax, eax
je 0x140087c07
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0xa0]
mov r8d, 0x10
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0xa0], 0x10
je 0x140087b11
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140087c1d
mov ecx, dword [rsp + 0x60]
call fcn.14008c4a0
mov rdi, rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0xa0]
mov r8d, dword [rsp + 0x60]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x60]
cmp dword [rsp + 0xa0], r11d
je 0x140087b60
mov rcx, rdi
call fcn.14008c4f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140087c1d
mov ecx, dword [rsp + 0x64]
call fcn.14008c4a0
mov rsi, rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0xa0]
mov r8d, dword [rsp + 0x64]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x64]
cmp dword [rsp + 0xa0], r11d
je 0x140087bb4
mov rcx, rdi
call fcn.14008c4f0
mov rcx, rsi
call fcn.14008c4f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140087c1d
mov ecx, 0x38
call fcn.14008c4a0
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x140087be3
mov r9d, dword [rsp + 0x64]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.140087740
mov rdx, rax
jmp 0x140087be6
mov rdx, r13
mov eax, dword [rsp + 0x5c]
mov dword [rdx + 0x10], eax
lea rcx, [r12 + 8]
call fcn.140038ce0
mov eax, dword [rsp + 0x50]
add eax, 0xffffffff
mov dword [rsp + 0x50], eax
jmp 0x140087ad0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140087c1d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140089130
Capabilities:
Delete file

Disassembly:
test rcx, rcx
je 0x140089241
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x130], rax
test rdx, rdx
mov rbx, rdx
mov rdi, rcx
je 0x140089221
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1400c2840
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140006d40
test eax, eax
je 0x140089221
lea r8, [rsp + 0x20]
lea rdx, [0x1400fcfb8]
mov ecx, 4
call fcn.140095c10
test rax, rax
mov rbx, rax
je 0x140089216
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xd0]
mov r11, qword [rdi + 0x298]
mov rdx, qword [rbx + 0x298]
add r11, 0xe44
add rdx, 0xe44
nop
nop
movzx eax, byte [r11]
add rdx, 1
add r11, 1
test al, al
mov byte [rdx - 1], al
jne 0x1400891e0
mov rax, qword [rdi]
mov r8d, 0x3911b7f
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0xc0]
mov r11, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r11]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400c2a20
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret 0

Function at 0x140089139
Capabilities:
Delete file

Disassembly:
test rcx, rcx
je 0x140089241
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x130], rax
test rdx, rdx
mov rbx, rdx
mov rdi, rcx
je 0x140089221
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1400c2840
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140006d40
test eax, eax
je 0x140089221
lea r8, [rsp + 0x20]
lea rdx, [0x1400fcfb8]
mov ecx, 4
call fcn.140095c10
test rax, rax
mov rbx, rax
je 0x140089216
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xd0]
mov r11, qword [rdi + 0x298]
mov rdx, qword [rbx + 0x298]
add r11, 0xe44
add rdx, 0xe44
nop
nop
movzx eax, byte [r11]
add rdx, 1
add r11, 1
test al, al
mov byte [rdx - 1], al
jne 0x1400891e0
mov rax, qword [rdi]
mov r8d, 0x3911b7f
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0xc0]
mov r11, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r11]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400c2a20
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret 0
Function at 0x140089310
Capabilities:
Get common file path
Move file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x250], rax
movsxd rdi, r8d
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x14008946c
cmp edi, 0xd
jge 0x14008946c
test r9, r9
je 0x140089374
cmp byte [r9], 0
je 0x140089374
lea rcx, [rsp + 0x30]
movzx eax, byte [r9]
mov byte [rcx], al
add r9, 1
add rcx, 1
test al, al
jne 0x140089360
jmp 0x140089384
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x30]
call fcn.1400b3390
mov r11, rdi
lea rdx, str.dhcplex.dll
lea rdi, [rsp + 0x30]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rdx, qword [rdx + r11*8]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400893b0
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x140089451
lea rcx, [rsp + 0x30]
call fcn.1400b6a90
test eax, eax
je 0x140089451
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x140]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400893f0
mov edx, 0x2e
lea rcx, [rsp + 0x140]
call fcn.1400c2dd0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movzx r8d, ax
lea rdx, str._04X.xxx
mov rcx, rdi
call fcn.1400c2cf0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
xor edx, edx
lea rcx, [rsp + 0x140]
call fcn.1400b8880
mov r8, rsi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400b85c0
mov eax, 1
mov dword [rsp + 0x20], eax
jmp 0x140089474
xor eax, eax
jmp 0x140089474
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400894c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x260
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r13d, r8d
mov r12, rdx
mov rbx, rcx
test rcx, rcx
jne 0x140089507
xor eax, eax
jmp 0x140089606
test r9, r9
je 0x140089534
cmp byte [r9], 0
je 0x140089534
lea rcx, [rsp + 0x140]
nop
nop
movzx eax, byte [r9]
mov byte [rcx], al
add r9, 1
add rcx, 1
test al, al
jne 0x140089520
jmp 0x140089547
mov edx, 0x104
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x140]
call fcn.1400b3390
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x30]
movzx eax, byte [rdx]
mov byte [rcx], al
add rdx, 1
add rcx, 1
test al, al
jne 0x140089561
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rsi, [rsp + rcx + 0x2f]
mov rcx, rsi
call fcn.1400b23b0
lea rdi, [rsp + 0x30]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [r12 + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400895a0
lea rcx, [rsp + 0x30]
call fcn.1400b6a90
test eax, eax
jne 0x140089587
test r13d, r13d
je 0x1400895e3
nop
nop
nop
movzx eax, byte [rsi]
mov byte [rbx], al
add rsi, 1
add rbx, 1
test al, al
jne 0x1400895d0
jmp 0x140089601
lea rcx, [rsp + 0x30]
nop
nop
movzx eax, byte [rcx]
mov byte [rbx], al
add rcx, 1
add rbx, 1
test al, al
jne 0x1400895f0
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400c2a20
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140089660
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1400896b6
mov esi, 1
mov dword [rsp + 0x20], esi
jmp 0x140089794
mov esi, 1
mov dword [rsp + 0x20], esi
mov byte [rsp + 0x30], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x31]
call fcn.1400c2840
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x30]
call fcn.1400b3390
xor ebx, ebx
mov dword [rsp + 0x24], ebx
lea r12, str.dhcplex.dll
nop
cmp ebx, 0xd
jae 0x140089794
mov byte [rsp + 0x140], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x141]
call fcn.1400c2840
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x140]
movzx eax, byte [rdx]
mov byte [rcx], al
add rdx, rsi
add rcx, rsi
test al, al
jne 0x140089733
lea rdi, [rsp + 0x140]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov r8, qword [r12 + rbx*8]
xor ecx, ecx
nop
nop
movzx eax, byte [r8 + rcx]
mov byte [rdi + rcx - 1], al
add rcx, rsi
test al, al
jne 0x140089760
lea rcx, [rsp + 0x140]
call fcn.1400b6a90
test eax, eax
je 0x140089789
xor esi, esi
mov dword [rsp + 0x20], esi
jmp 0x140089794
add ebx, esi
mov dword [rsp + 0x24], ebx
jmp 0x140089700
mov eax, esi
jmp 0x14008979c
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400c2a20
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret