joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c72c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x17e0
call fcn.140037150
sub rsp, rax
mov rax, qword [0x140049e00]
xor rax, rsp
mov qword [rsp + 0x17d0], rax
mov qword [rsp + 0x48], rdx
mov rbx, r8
mov rdx, rcx
lea rcx, [rsp + 0x60]
lea r8, str.SOFTWAREej_technologiesexe4jjvms_
xor dil, dil
call fcn.14000c5c4
lea r11, [rsp + 0x38]
lea rdx, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000c89f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.LastWriteTime
xor r8d, r8d
mov dword [rsp + 0x30], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000c894
cmp dword [rsp + 0x30], 8
jne 0x14000c894
lea r8d, [rax + 8]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.14001e3b0
test eax, eax
jne 0x14000c894
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.Version
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], 0x1770
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete dil
test dil, dil
je 0x14000c894
cmp dword [rsp + 0x30], 1
jae 0x14000c849
mov byte [rbx], 0
jmp 0x14000c858
mov eax, dword [rsp + 0x30]
cmp byte [rax + rbx - 1], 0
je 0x14000c858
mov byte [rax + rbx], 0
lea rdx, str.1.7.
mov rcx, rbx
call fcn.14001c700
test eax, eax
je 0x14000c891
lea rdx, str.1.6.
mov rcx, rbx
call fcn.14001c700
test eax, eax
je 0x14000c891
lea rdx, str.1.5.
mov rcx, rbx
call fcn.14001c700
test eax, eax
jne 0x14000c894
xor dil, dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, dil
mov rcx, qword [rsp + 0x17d0]
xor rcx, rsp
call fcn.14001ae80
mov rbx, qword [rsp + 0x1808]
add rsp, 0x17e0
pop rdi
ret

Function at 0x14000c8c4
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor r8d, r8d
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ebx, ebx
movsxd rsi, eax
test eax, eax
jle 0x14000c946
mov rcx, rsi
call fcn.140019b3c
mov r8d, esi
mov rcx, rdi
mov rdx, rax
mov rbx, rax
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [rsi - 1]
cmp eax, ecx
je 0x14000c929
mov rcx, rbx
call fcn.14001aaec
lea rcx, str.error_reading__S
mov rdx, rdi
xor ebx, ebx
call fcn.140013de8
jmp 0x14000c93b
lea rcx, str._S_is__S
mov r8, rbx
mov rdx, rdi
call fcn.140013de8
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c95c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [r11 - 0x10]
mov rdi, r9
mov rsi, r8
mov r9d, 0x20019
xor r8d, r8d
xor ebx, ebx
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x14000c9c4
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
cmp eax, ebx
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14000cab0
Capabilities:
Check os version
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1840
call fcn.140037150
sub rsp, rax
mov rax, qword [0x140049e00]
xor rax, rsp
mov qword [rsp + 0x1830], rax
mov rdi, rcx
mov ebx, 0x94
lea rcx, [rsp + 0x20]
mov r8, rbx
xor edx, edx
call fcn.14001cb10
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x24], 6
jb 0x14000cb13
jne 0x14000cbc9
cmp dword [rsp + 0x28], 4
jae 0x14000cbc9
mov rcx, rdi
call fcn.14001a6c0
lea rcx, [rax + 0x64]
call fcn.140019b3c
lea rdx, str._sucrtbase.dll
mov r8, rdi
mov rcx, rax
mov rbx, rax
call fcn.14001bb88
mov rcx, rbx
call fcn.140005bc0
test al, al
je 0x14000cbc1
lea rcx, str.Preloading_ucrtbase.dll_4
call fcn.140013de8
lea rdx, [rsp + 0xc0]
mov ecx, 0x1770
mov byte [rsp + 0xc0], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.ucrtbase.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000cba1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000cba1
lea rcx, str.Could_not_preload_ucrtbase.dll
call fcn.140013de8
lea rcx, [rsp + 0xc0]
call fcn.14001a6c0
test rax, rax
je 0x14000cbc1
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rcx, rbx
call fcn.14001aaec
mov rcx, qword [rsp + 0x1830]
xor rcx, rsp
call fcn.14001ae80
mov rbx, qword [rsp + 0x1858]
add rsp, 0x1840
pop rdi
ret
Function at 0x140011eac
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x46c8
call fcn.140037150
sub rsp, rax
mov rax, qword [0x140049e00]
xor rax, rsp
mov qword [rsp + 0x46b0], rax
mov r12, qword [rsp + 0x4720]
mov r13, qword [rsp + 0x4728]
mov ebx, edx
mov rdi, r8
mov rsi, rcx
lea rdx, [rsp + 0x60]
mov r8d, 0x1770
mov ecx, 0xa0
mov rbp, r9
call fcn.140004548
lea rdx, [rsp + 0x60]
lea rcx, str.checking_app_id__S___d___p_
mov r9, rsi
mov r8d, ebx
call fcn.140013de8
lea rcx, [rsp + 0x60]
call fcn.14001a6c0
test rax, rax
je 0x14001208a
lea rax, [rsp + 0x48]
or ebx, 0x20019
lea rdx, str.SOFTWAREej_technologiesinstall4jinstallations
xor r8d, r8d
mov rcx, rsi
mov r9d, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001207c
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f40]
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x40], 0x1770
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140012061
cmp dword [rsp + 0x40], eax
jbe 0x140012061
lea rdx, [rsp + 0x2f40]
lea rcx, str.found_installations:__S
call fcn.140013de8
lea rcx, [rsp + 0x2f40]
lea rdx, [0x14003a2fc]
call fcn.14001b9cc
mov rbx, rax
test rax, rax
je 0x14001206f
mov rcx, rax
call fcn.14001a6c0
test rax, rax
je 0x14001206f
lea rdx, str._sjre
lea rcx, [rsp + 0x17d0]
mov r8, rbx
call fcn.14001bb88
lea rdx, [rsp + 0x17d0]
mov rcx, rdi
call fcn.14000c504
test al, al
je 0x140012042
mov byte [rsp + 0x30], 1
mov r9, r13
mov r8, r12
mov rdx, rbp
mov rcx, rdi
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
call fcn.140011c28
test al, al
jne 0x14001205d
lea rcx, str.java_version_did_not_match_in__S
jmp 0x140012049
lea rcx, str.did_not_find_java_in__S
lea rdx, [rsp + 0x17d0]
call fcn.140013de8
xor ecx, ecx
jmp 0x140011fc1
mov al, 1
jmp 0x14001208c
lea rcx, str.could_not_query_value_node__d
xor edx, edx
call fcn.140013de8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001208a
lea rcx, str.could_not_open_installation_node__d
mov edx, eax
call fcn.140013de8
xor al, al
mov rcx, qword [rsp + 0x46b0]
xor rcx, rsp
call fcn.14001ae80
add rsp, 0x46c8
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140012328
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x17c0
call fcn.140037150
sub rsp, rax
mov rax, qword [0x140049e00]
xor rax, rsp
mov qword [rsp + 0x17b0], rax
mov r14, qword [rsp + 0x1820]
mov rax, r8
mov r12, rdx
mov rbp, rcx
lea rdx, [rsp + 0x40]
mov r8d, 0x1770
mov rcx, rax
mov r13, r9
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400123ef
lea rcx, [rsp + 0x40]
xor esi, esi
call fcn.14001a6c0
lea ebx, [rsi + 1]
test rax, rax
je 0x1400123b6
lea rdi, [rsp + 0x40]
cmp byte [rdi], 0x2f
jne 0x14001239f
mov byte [rdi], 0x5c
lea rcx, [rsp + 0x40]
add esi, ebx
add rdi, rbx
call fcn.14001a6c0
movsxd rcx, esi
cmp rcx, rax
jb 0x140012397
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.14000c504
test al, al
je 0x1400123e9
mov byte [rsp + 0x30], bl
mov r9, r14
mov r8, r13
mov rdx, r12
mov rcx, rbp
mov byte [rsp + 0x28], bl
mov byte [rsp + 0x20], 0
call fcn.140011c28
test al, al
jne 0x1400123eb
xor ebx, ebx
mov al, bl
jmp 0x1400123f1
xor al, al
mov rcx, qword [rsp + 0x17b0]
xor rcx, rsp
call fcn.14001ae80
add rsp, 0x17c0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140012670
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea rax, [r11 - 0x40]
mov r12, r9
mov r14, r8
xor bpl, bpl
xor r8d, r8d
mov qword [r11 - 0x68], rax
mov byte [r9], bpl
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140012864
mov edi, 0x1770
mov rcx, rdi
mov dword [rsp + 0xa8], edi
mov dword [rsp + 0x40], edi
call fcn.140019b3c
mov rcx, rdi
mov r13, rax
call fcn.140019b3c
mov rcx, rdi
mov rsi, rax
call fcn.140019b3c
mov rcx, rdi
mov rbx, rax
call fcn.140019b3c
xor r15d, r15d
mov rdi, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
and qword [rsp + 0x20], r15
xor edx, edx
jmp 0x14001281b
mov byte [rbx], 0
mov rcx, rsi
mov byte [rdi], 0
call fcn.14001a6c0
inc eax
movsxd r8, eax
test eax, eax
jle 0x140012759
mov rdx, rsi
mov rcx, rbx
sub rdx, rbx
movzx eax, byte [rdx + rcx]
mov r9d, 0x5c
cmp al, 0x2f
cmove eax, r9d
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x14001273e
lea rdx, str.i4j_jres
mov rcx, rbx
call fcn.14001d074
test rax, rax
setne al
cmp byte [rsp + 0xc0], 0
je 0x14001277c
test al, al
je 0x14001278a
cmp byte [rsp + 0xc8], 0
je 0x1400127e0
test al, al
je 0x1400127e0
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov byte [rsp + 0x30], 1
mov rdx, rdi
mov rcx, rbx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
call fcn.140011c28
test al, al
je 0x1400127e0
mov rdx, r12
mov rcx, rdi
call fcn.140010cbc
test al, al
je 0x1400127e0
mov rdx, rdi
mov rcx, r12
call fcn.14001ad30
mov rdx, rbx
mov rcx, r14
call fcn.14001ad30
mov bpl, 1
lea rax, [rsp + 0x50]
inc r15d
mov dword [rsp + 0xa8], 0x1770
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xa8]
mov dword [rsp + 0x40], 0x1770
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
and qword [rsp + 0x20], 0
mov edx, r15d
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x14001271e
mov rcx, rbx
call fcn.14001aaec
mov rcx, rdi
call fcn.14001aaec
mov rcx, r13
call fcn.14001aaec
mov rcx, rsi
call fcn.14001aaec
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
mov al, bpl
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400133d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r10, rdx
test r8d, r8d
jle 0x140013404
mov r9d, r8d
mov r8d, dword [rcx]
movsx eax, byte [r10]
inc r10
xor rax, r8
shr r8d, 8
movzx edx, al
lea rax, [0x1400494a0]
mov eax, dword [rax + rdx*4]
xor eax, r8d
sub r9, 1
mov dword [rcx], eax
jne 0x1400133db
repz ret

Function at 0x140013808
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.14001a6c0
cmp eax, 3
jl 0x1400138c7
cmp byte [rbx + 1], 0x2d
jne 0x1400138c7
mov rcx, qword [0x140049498]
lea rdi, [0x140049498]
jmp 0x14001389c
mov rsi, qword [rdi]
mov rcx, rsi
call fcn.14001a6c0
mov rbp, rax
lea ecx, [rax + 1]
movsxd rcx, ecx
call fcn.140019b3c
test ebp, ebp
jle 0x14001387e
movsxd r8, ebp
mov rdx, rax
sub rsi, rax
mov cl, byte [rsi + rdx]
xor cl, 0xbb
mov byte [rdx], cl
inc rdx
sub r8, 1
jne 0x14001386d
movsxd r8, ebp
mov rdx, rax
mov rcx, rbx
mov byte [r8 + rax], 0
call fcn.14001bad0
test eax, eax
je 0x1400138c7
add rdi, 8
mov rcx, qword [rdi]
call fcn.14001a6c0
test rax, rax
jne 0x140013847
movsx ecx, byte [rbx]
sub ecx, 0x41
je 0x1400138fd
sub ecx, 4
je 0x1400138f1
sub ecx, 7
je 0x1400138fd
sub ecx, 7
je 0x1400138fd
sub ecx, 1
je 0x1400138e1
cmp ecx, 3
je 0x1400138fd
mov eax, 0xfffffffd
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140013234
add eax, 0xfffffffc
cmp eax, 1
jmp 0x14001390b
mov dl, 1
mov rcx, rbx
call fcn.140013778
jmp 0x1400138cc
mov rcx, rbx
call fcn.140013234
add eax, 0xfffffffe
cmp eax, 2
ja 0x1400138c7
mov rcx, rbx
call fcn.140013678
neg al
sbb eax, eax
and eax, 2
add eax, 0xfffffffd
jmp 0x1400138cc
Function at 0x140013e68
Capabilities:
Set registry value

Disassembly:
mov eax, 0x17e8
call fcn.140037150
sub rsp, rax
mov rax, qword [0x140049e00]
xor rax, rsp
mov qword [rsp + 0x17d0], rax
call fcn.140005ca0
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov rdx, rax
call fcn.1400071a4
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, str.SOFTWAREej_technologiesexe4jpids_
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140013f1a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x58]
mov r9d, 4
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x17d0]
xor rcx, rsp
call fcn.14001ae80
add rsp, 0x17e8
ret

Function at 0x140013f34
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
mov eax, 0x17d0
call fcn.140037150
sub rsp, rax
mov rax, qword [0x140049e00]
xor rax, rsp
mov qword [rsp + 0x17c0], rax
call fcn.140005ca0
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov rdx, rax
call fcn.1400071a4
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREej_technologiesexe4jpids_
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x140013fe4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x140013fd9
cmp dword [rsp + 0x30], 4
cmove ebx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x17c0]
xor rcx, rsp
call fcn.14001ae80
add rsp, 0x17d0
pop rbx
ret
Function at 0x14001434c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
call fcn.140014054
mov rcx, rbx
mov rsi, rax
call fcn.14001b1d8
lea rbp, str.__i4j_empty_command_line
test rax, rax
mov edx, 0x40000000
mov rcx, rsi
cmovne rbp, rbx
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor ebx, ebx
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001441b
mov ecx, ebx
inc ebx
cmp ecx, 0x32
jge 0x1400143ff
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400143b7
cmp rdi, 0xffffffffffffffff
jne 0x14001441b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_mailslot_CreateFile__d
mov edx, eax
call fcn.140013de8
jmp 0x14001447c
mov rcx, rbp
call fcn.14001b1d8
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov rbx, rax
mov rdx, rbp
mov rcx, rdi
add ebx, ebx
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14001445c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_mailslot_WriteFile__d
mov edx, eax
call fcn.140013de8
jmp 0x140014473
mov edx, dword [rsp + 0x60]
cmp edx, ebx
je 0x140014473
lea rcx, str.error_mailslot_WriteFile_length__d__d
mov r8d, ebx
call fcn.140013de8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
jmp fcn.14001aaec
Function at 0x1400147e0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
movss xmm0, dword [0x140049cb8]
and dword [rax + 0x20], 0
and dword [rax - 0x38], 0
ucomiss xmm0, dword [0x14003dff0]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm7, xmm7
jp 0x140014882
jne 0x140014882
movss xmm6, dword [0x14003dfec]
lea rcx, str.J2D_UISCALE
movss dword [0x140049cb8], xmm6
call fcn.14001e2f8
test rax, rax
je 0x14001487a
xor edx, edx
mov rcx, rax
call fcn.14001f09c
cvtsd2ss xmm1, xmm0
movss dword [0x140049cb8], xmm1
call fcn.14001ee90
cmp dword [rax], 0x22
je 0x14001486d
movss xmm0, dword [0x140049cb8]
comiss xmm7, xmm0
jb 0x140014882
movaps xmm0, xmm6
movss dword [0x140049cb8], xmm0
jmp 0x140014882
movss xmm0, dword [0x140049cb8]
comiss xmm0, xmm7
jbe 0x140014894
movss dword [rbx], xmm0
movss dword [rdi], xmm0
jmp 0x140014981
cmp qword [0x140057450], 0
jne 0x1400148d0
lea rcx, str.shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140057450], rax
test rax, rax
je 0x1400148d0
lea rdx, str.GetDpiForMonitor
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140057448], rax
jmp 0x1400148d7
mov rax, qword [0x140057448]
test rax, rax
je 0x140014919
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x78]
xor edx, edx
mov rcx, rsi
call rax
test eax, eax
jne 0x140014981
mov eax, dword [rsp + 0x78]
pxor xmm0, xmm0
pxor xmm1, xmm1
cvtsi2ss xmm0, rax
mov eax, dword [rsp + 0x20]
cvtsi2ss xmm1, rax
movss dword [rdi], xmm0
movss dword [rbx], xmm1
jmp 0x140014981
lea rcx, str.D2d1.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140057440], rax
test rax, rax
je 0x140014981
lea rdx, [0x14003df90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140057438], rax
test rax, rax
je 0x140014981
lea r9, [rsp + 0x28]
lea rdx, [0x14003df80]
xor r8d, r8d
xor ecx, ecx
call rax
test eax, eax
jne 0x140014981
mov rcx, qword [rsp + 0x28]
mov r8, rbx
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rdi
ret
Function at 0x140016704
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [0x140058bf5], 0
mov rbx, rcx
je 0x14001675b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001675b
mov rcx, rbx
call fcn.14001a6c0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8, rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x140016771
mov rcx, rbx
call fcn.14001f0a4
call fcn.14001c170
lea rcx, [rax + 0x30]
call fcn.14001bfa8
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400167d0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x140049e00]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x14001685b
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x94
call fcn.14001cb10
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x24], 6
jne 0x140016833
cmp dword [rsp + 0x28], 0
je 0x14001685b
lea rdx, str.SetDefaultDllDirectories
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001685b
mov ecx, 0xc00
call rax
lea rcx, str.restrict_DLL_directories
call fcn.140013de8
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14001ae80
add rsp, 0xd0
pop rbx
ret

Function at 0x140016874
Capabilities:
Create directory

Disassembly:
push rbx
mov eax, 0x17a0
call fcn.140037150
sub rsp, rax
mov rax, qword [0x140049e00]
xor rax, rsp
mov qword [rsp + 0x1790], rax
xor ebx, ebx
lea rcx, [rsp + 0x20]
call fcn.140006e84
xor ecx, ecx
call fcn.14001c664
lea r8, [rsp + 0x20]
lea rdx, str._s_dir_d
lea rcx, [0x140057460]
mov r9, rax
call fcn.14001bb88
lea rdx, [0x140057460]
lea rcx, str.Temp_dir3:__S
call fcn.140013de8
lea rcx, [0x140057460]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14001691c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14003ea10]
mov edx, eax
call fcn.140013de8
inc ebx
cmp ebx, 0xa
jl 0x140016897
lea rdx, [0x14003ea0c]
mov ecx, 0x3f1
mov byte [0x140057460], 0
call fcn.140004f98
mov rcx, qword [rsp + 0x1790]
xor rcx, rsp
call fcn.14001ae80
add rsp, 0x17a0
pop rbx
ret
Function at 0x140016938
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x48
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov rcx, rax
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400169be
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400169be
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
add rsp, 0x48
ret

Function at 0x140016b20
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, 0xbb80
mov rcx, rbx
call fcn.140019b3c
mov ecx, 0x2ee0
mov rdi, rax
call fcn.140019b3c
mov r8d, 0x1770
mov rdx, rax
mov ecx, 0x2714
mov rsi, rax
call fcn.140004548
lea rcx, str.native_lib_dir_is__S
mov rdx, rsi
call fcn.140013de8
mov rcx, rsi
call fcn.140008d58
lea r8, [0x140016af8]
mov rdx, rsi
mov rcx, rdi
call fcn.140007354
mov rcx, rdi
call fcn.14001a6c0
test rax, rax
je 0x140016bb3
mov rcx, rdi
call fcn.14001a6c0
cmp byte [rax + rdi - 1], 0x3b
je 0x140016bb3
lea rdx, [0x14003a2fc]
mov rcx, rdi
call fcn.14001ac90
mov rcx, rdi
call fcn.14001a6c0
mov rcx, rdi
sub ebx, eax
call fcn.14001a6c0
lea rcx, [0x14003c638]
lea rdx, [rdi + rax]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rcx, [0x14003c638]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x140016bfe
lea rcx, str.Setting_PATH__native_libs___S
mov rdx, rdi
call fcn.140013de8
jmp 0x140016c16
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Setting_PATH__native_libs___S_failed_with_error__d
mov rdx, rdi
mov r8d, eax
call fcn.140013de8
mov rcx, rdi
call fcn.14001a6c0
lea rcx, [rax + 6]
call fcn.140019b3c
lea rdx, str.PATH_s
mov r8, rdi
mov rcx, rax
mov rbx, rax
call fcn.14001bb88
mov rcx, rbx
call fcn.14001e71c
mov rcx, rbx
call fcn.14001aaec
mov rcx, rdi
call fcn.14001aaec
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14001aaec