joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400172e4
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x6d0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x14004b138]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov ebx, ecx
mov rdi, qword [rsp + 0x708]
xor esi, esi
cmp rdi, rsi
je 0x140017329
mov dword [rdi], esi
cmp edx, 0xffff
je 0x14001735c
movzx eax, dx
mov ecx, 0x3ff
and ax, cx
mov ecx, 0x7f
cmp cx, ax
je 0x14001735c
mov ecx, edx
call fcn.14002bf68
cmp al, sil
jne 0x14001735c
mov eax, 0x80070057
jmp 0x14001743c
cmp r8, rsi
jl 0x140017437
mov eax, r9d
not eax
mov ecx, dword [rsp + 0x700]
test ecx, eax
jne 0x140017437
lea rbp, [0x140004110]
mov qword [rsp + 0x30], rbp
or qword [rsp + 0x38], 0xffffffffffffffff
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edx
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x54], ecx
mov word [rsp + 0x4b0], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x4b2]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x260], esi
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x264]
call sub.msvcrt.dll_memset
cmp ebx, esi
jle 0x14001741d
lea r8, [rsp + 0x4b0]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x30]
call fcn.14001d0bc
cmp eax, esi
jne 0x14001741d
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp ebx, 0x7fffffff
jge 0x140017419
sub ebx, dword [rsp + 0x280]
cmp ebx, esi
jg 0x1400173de
cmp rdi, rsi
je 0x140017424
mov dword [rdi], ebx
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x30]
call fcn.14001d070
xor eax, eax
jmp 0x14001743c
mov eax, 0x80070057
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.14003a6d0
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14001ce50
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
lea rcx, [0x1400040a0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x14001ce7e
mov ebx, 0x80004005
jmp 0x14001cea0
mov rcx, rdi
call fcn.14002cfe8
mov ebx, eax
test eax, eax
js 0x14001cea0
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ecx, 0x800700ce
test rax, rax
cmove ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001d0bc
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x260
mov rax, qword [0x14004b138]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r14d, r14d
mov r13, r8
mov rsi, rdx
mov rbx, rcx
mov word [r8], r14w
cmp rdx, r14
jne 0x14001d0ff
mov eax, 0x80070057
jmp 0x14001d249
xor edx, edx
mov r8d, 0x250
mov rcx, rsi
call sub.msvcrt.dll_memset
mov ebp, 0x104
mov rcx, qword [rbx + 8]
mov edi, 1
cmp rcx, 0xffffffffffffffff
jne 0x14001d18d
lea r12, [rbx + 0x28]
mov rcx, r12
call fcn.14001ce50
cmp eax, r14d
jl 0x14001d249
mov eax, dword [rbx + 0x24]
mov r9d, dword [rbx + 0x14]
mov r8d, dword [rbx + 0x10]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x40]
mov rdx, rbp
mov qword [rsp + 0x20], r14
call fcn.14001ceb4
cmp eax, r14d
jl 0x14001d249
lea rcx, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x14001d19b
mov eax, edi
jmp 0x14001d249
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r14d
je 0x14001d1d4
lea rcx, [rsi + 0x2c]
mov edx, 0x5f
mov r12, r14
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, r14
je 0x14001d1c5
xor edx, edx
lea rcx, [rax + 2]
lea r8d, [rdx + 0x24]
call qword [sym.imp.msvcrt.dll__wcstoi64]
mov r12, rax
cmp r12, qword [rbx + 0x18]
jle 0x14001d114
mov eax, r14d
jmp 0x14001d1e2
mov rcx, rbx
call fcn.14001d070
cmp eax, r14d
cmovge eax, edi
cmp eax, r14d
jne 0x14001d249
add rbx, 0x28
mov rcx, r13
mov edx, r14d
sub rbx, r13
lea rax, [rbp + 0x7ffffefa]
cmp rax, r14
je 0x14001d216
movzx eax, word [rbx + rcx]
cmp ax, r14w
je 0x14001d216
mov word [rcx], ax
add rcx, 2
sub rbp, rdi
jne 0x14001d1f4
cmp rbp, r14
jne 0x14001d224
sub rcx, 2
mov edx, 0x8007007a
cmp edx, r14d
mov word [rcx], r14w
jge 0x14001d231
mov eax, edx
jmp 0x14001d249
lea rdx, [rsi + 0x2c]
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
neg eax
sbb eax, eax
not eax
and eax, 0x80004005
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14003a6d0
add rsp, 0x260
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001e1e4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
test rcx, rcx
je 0x14001e2fb
and dword [rcx], 0
and qword [rax - 0x28], 0
and qword [rax - 0x20], 0
and qword [rax - 0x18], 0
xor ebx, ebx
lea r8, [0x140002670]
and qword [rax - 0x30], rbx
and qword [rax - 0x38], rbx
and dword [rax + 8], ebx
mov dword [rax - 0x40], 0x2011f
and dword [rax - 0x48], ebx
lea rcx, [rax - 0x28]
xor r9d, r9d
mov rdx, 0xffffffff80000001
call fcn.140008158
test eax, eax
jne 0x14001e2d7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, [0x140002658]
xor r8d, r8d
mov dword [rsp + 0x78], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001e28e
cmp dword [rsp + 0x80], 4
jne 0x14001e29c
cmp eax, 2
je 0x14001e29c
cmp eax, 0xd
je 0x14001e29c
test eax, eax
jne 0x14001e2d7
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x140002658]
inc eax
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001e2de
mov ebx, 0x80004005
jmp 0x14001e2e4
mov edx, dword [rsp + 0x70]
mov dword [rdi], edx
cmp qword [rsp + 0x40], 0
je 0x14001e2f7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14001e300
mov eax, 0x80070057
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x14001eed4
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Query environment variable

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x14004b138]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r14, r8
mov r13, rdx
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov bpl, r15b
mov r8d, 0x20119
lea rdx, [rsp + 0x40]
call fcn.140023468
cmp eax, r15d
jl 0x14001f0c4
mov rax, qword [r13 + 8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14001f0c4
mov edi, dword [rbx + 0x28]
mov word [rsp + 0x70], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x72]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x70]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r15d
je 0x14001f034
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001f034
mov word [rsp + 0x60], r15w
xor eax, eax
mov dword [rsp + 0x62], eax
lea r9d, [rax + 0xa]
lea r8d, [rax + 3]
lea rdx, [rsp + 0x60]
mov ecx, edi
call sub.msvcrt.dll__itow_s
cmp eax, r15d
jne 0x14001f034
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x14001f034
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x18]
call qword [sym.imp.ole32.dll_StringFromCLSID]
cmp eax, r15d
jne 0x14001f026
mov rdx, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
movzx ebp, bpl
mov ecx, 1
cmp eax, r15d
cmove ebp, ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rdi, r15
je 0x14001f034
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rbx + 0x39], r15b
je 0x14001f050
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14003af80
jmp 0x14001f094
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x39], r15b
jne 0x14001f074
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x39], r15b
jne 0x14001f094
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x39], r15b
je 0x14001f066
jmp 0x14001f094
mov rax, qword [rbx + 8]
cmp byte [rax + 0x39], r15b
jne 0x14001f091
cmp rbx, qword [rax + 0x10]
jne 0x14001f091
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x39], r15b
je 0x14001f07e
mov rbx, rax
cmp rbx, qword [r13 + 8]
jne 0x14001ef46
cmp bpl, r15b
je 0x14001f0c4
mov rax, qword [r14]
mov qword [rsp + 0x20], r15
lea r9, [0x140003924]
mov edx, 0x8000006d
mov r8d, 4
mov rcx, r14
call qword [rax + 0x18]
nop
cmp qword [rsp + 0x40], r15
je 0x14001f0d6
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14003a6d0
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x14001f574
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x4c0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x14004b138]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov ebx, r9d
mov rsi, r8
mov r14, rdx
mov edi, ecx
mov r13, qword [rsp + 0x520]
xor eax, eax
mov r12, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov rbp, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x2a0], ax
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2a2]
call sub.msvcrt.dll_memset
xor eax, eax
mov word [rsp + 0x90], ax
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x92]
call sub.msvcrt.dll_memset
lea r8d, [rbp + 0x10]
lea rdx, [rsp + 0x2a0]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__itow]
lea r8d, [rbp + 0x10]
lea rdx, [rsp + 0x90]
mov ecx, edi
call qword [sym.imp.msvcrt.dll__itow]
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x78], rdi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14002c074
mov ebx, eax
cmp eax, edi
jl 0x14001f75f
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.14001eba8
mov ebx, eax
cmp eax, edi
jl 0x14001f75f
mov r8d, 0x20106
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140023468
mov ebx, eax
cmp eax, edi
jl 0x14001f75a
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [rsp + 0x2a0]
mov r12, qword [rsp + 0x60]
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.140008158
mov esi, 0x80004005
cmp eax, edi
cmovne ebx, esi
cmp ebx, edi
jl 0x14001f753
mov rcx, r13
call fcn.14002c00c
cmp rax, rdi
jbe 0x14001f733
mov eax, edi
cmp r13, rdi
setne al
cmp eax, edi
jne 0x14001f6ff
mov ecx, esi
call fcn.140007c44
int3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x14001f74c
mov rdx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
cmove eax, edi
cmp eax, edi
cmovne ebx, esi
jmp 0x14001f75f
mov rbp, qword [rsp + 0x48]
jmp 0x14001f75f
mov r12, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
cmp rbp, rdi
je 0x14001f783
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp r12, rdi
je 0x14001f791
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.14003a6d0
add rsp, 0x4c0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140021ac8
Capabilities:
Delete file
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14004b138]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rax, [0x140004340]
mov rbx, rcx
mov dword [rcx + 8], 0xc0000001
mov qword [rcx], rax
call fcn.1400238e4
mov rcx, qword [rbx + 0x38]
call fcn.14002c00c
xor esi, esi
cmp rax, rsi
jbe 0x140021bb4
mov r8d, dword [rbx + 0x30]
lea rdx, [rbx + 0x20]
lea rcx, [rbx + 0x10]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], rsi
call fcn.1400235c8
cmp eax, esi
mov edi, eax
jl 0x140021b9b
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x400
call sub.OLEAUT32.dll_VarR8Pow
cmp eax, 1
je 0x140021b9b
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], si
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x38]
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, 0x80004005
cmp eax, esi
cmove edi, ecx
cmp edi, esi
jl 0x140021b9b
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x20]
mov qword [rbx + 0x38], rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [0x14004c5a0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14003a6d0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400235c8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x4c0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x14004b138]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov rbp, r9
mov r13d, r8d
mov rbx, rdx
mov r12, rcx
xor r15d, r15d
cmp r9, r15
je 0x14002360f
mov qword [r9], r15
mov rdi, r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov rsi, r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov word [rsp + 0x2a0], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2a2]
call sub.msvcrt.dll_memset
mov word [rsp + 0x90], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x92]
call sub.msvcrt.dll_memset
mov r8d, 0x10
lea rdx, [rsp + 0x2a0]
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__itow]
mov qword [rsp + 0x48], r15
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14002c074
mov ebx, eax
cmp eax, r15d
jl 0x1400237b8
mov r8d, 0x20106
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.140023468
mov ebx, eax
cmp eax, r15d
jl 0x1400237b3
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20119
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [rsp + 0x2a0]
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140008158
mov r12d, 0x80004005
cmp eax, r15d
cmovne ebx, r12d
cmp ebx, r15d
jl 0x1400237ac
mov dword [rsp + 0x44], 0x208
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r15d
jne 0x140023781
cmp dword [rsp + 0x40], 1
je 0x140023758
cmp dword [rsp + 0x40], 2
jne 0x14002378b
mov eax, dword [rsp + 0x44]
cmp eax, r15d
je 0x140023775
test al, 1
jne 0x14002378b
shr rax, 1
cmp word [rsp + rax*2 + 0x8e], r15w
je 0x14002377e
jmp 0x14002378b
mov word [rsp + 0x90], r15w
mov eax, r15d
cmp eax, 2
je 0x14002378e
cmp eax, r15d
je 0x14002378e
mov ebx, r12d
cmp ebx, r15d
jl 0x1400237b8
cmp rbp, r15
je 0x1400237b8
lea rcx, [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp], rax
jmp 0x1400237b8
mov rsi, qword [rsp + 0x68]
jmp 0x1400237b8
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
cmp rsi, r15
je 0x1400237d3
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r15
je 0x1400237e1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.14003a6d0
add rsp, 0x4c0
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140023c70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x4a0
mov rax, qword [0x14004b138]
xor rax, rsp
mov qword [rsp + 0x490], rax
xor ebp, ebp
mov rsi, rdx
mov rdi, rcx
cmp rdx, rbp
je 0x140023e19
mov qword [rdx], rbp
lea r8d, [rbp + 0x4c]
lea rcx, [rsp + 0x22]
xor edx, edx
mov word [rsp + 0x20], bp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x280]
lea rdx, [0x1400041c0]
lea r8d, [rbp + 0x7e]
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x2fe]
xor edx, edx
mov r8d, 0x18a
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], bp
call sub.msvcrt.dll_memset
lea r8d, [rbp + 0x27]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, 0x27
je 0x140023d25
mov ebx, 0x80004005
jmp 0x140023e15
mov r12d, 0x104
cmp word [rsp + 0x280], bp
je 0x140023d75
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x280]
repne scasw ax, word [rdi]
not rcx
cmp word [rsp + rcx*2 + 0x27c], 0x5c
je 0x140023d75
lea r8, [0x140003870]
lea rcx, [rsp + 0x280]
mov rdx, r12
call fcn.14001d2b0
cmp eax, ebp
mov ebx, eax
jl 0x140023e15
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x280]
mov rdx, r12
call fcn.14001d2b0
cmp eax, ebp
mov ebx, eax
jl 0x140023e15
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
je 0x140023d1b
lea rcx, [rsp + 0x70]
call fcn.14002cfe8
cmp eax, ebp
mov ebx, eax
jl 0x140023e15
cmp word [rsp + 0x70], bp
je 0x140023df8
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
cmp word [rsp + rcx*2 + 0x6c], 0x5c
je 0x140023df8
lea r8, [0x140003870]
lea rcx, [rsp + 0x70]
mov rdx, r12
call fcn.14001d2b0
mov ebx, eax
cmp ebx, ebp
jl 0x140023e15
lea rcx, [rsp + 0x70]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, 0x8007000e
cmp rax, rbp
mov qword [rsi], rax
cmove ebx, ecx
mov eax, ebx
jmp 0x140023e1e
mov eax, 0x80070057
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.14003a6d0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140024058
Capabilities:
Move file
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x240
mov rax, qword [0x14004b138]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x38]
mov rsi, rdx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
xor r12d, r12d
cmp eax, r12d
ja 0x1400240a1
mov eax, 0x80004005
jmp 0x140024148
mov rcx, rdi
call fcn.1400238e4
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], r12w
mov ebx, eax
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, 0x80004005
cmp eax, r12d
cmove ebx, ebp
cmp ebx, r12d
jl 0x140024146
mov rcx, qword [rdi + 0x38]
lea rdx, [rsp + 0x20]
mov r8d, 0xb
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, r12d
cmove ebx, ebp
cmp ebx, r12d
jl 0x140024146
mov rcx, qword [rdi + 0x38]
mov ebx, r12d
cmp rcx, rsi
je 0x140024146
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp rsi, r12
je 0x140024142
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rdi + 0x38], rax
cmp rax, r12
jne 0x140024146
mov ebx, 0x8007000e
jmp 0x140024146
mov qword [rdi + 0x38], r12
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14003a6d0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x140024178
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2240
call fcn.14003bcb0
sub rsp, rax
mov rax, qword [0x14004b138]
xor rax, rsp
mov qword [rsp + 0x2230], rax
xor edi, edi
mov rbx, rcx
cmp rcx, rdi
je 0x140024220
mov qword [rcx], rdi
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x1ffe
mov word [rsp + 0x230], di
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x230]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x20]
lea rdx, [0x1400043e8]
lea rcx, [rsp + 0x230]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
xor eax, eax
jmp 0x140024225
mov eax, 0x80070057
mov rcx, qword [rsp + 0x2230]
xor rcx, rsp
call fcn.14003a6d0
mov rbx, qword [rsp + 0x2258]
add rsp, 0x2240
pop rdi
ret
Function at 0x14002cd6c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x14002cd98
mov rcx, rdx
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x14002ce9d
test rdi, rdi
je 0x14002ce9d
lea rdx, [0x1400047a4]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wfopen]
mov rsi, rax
test rax, rax
jne 0x14002cdd4
mov eax, 0x80004005
jmp 0x14002cea2
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x38]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wstat64]
mov r12, qword [rsp + 0x38]
mov r11d, 0xffffffff
cmp r12, r11
ja 0x14002cdca
mov ecx, 0x11
mov r8d, r12d
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
xor ebx, ebx
mov r13d, 0x8007000e
test rax, rax
mov rbp, rax
cmove ebx, r13d
and qword [rsp + 0x88], 0
test ebx, ebx
js 0x14002ce81
lea rdx, [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov ebx, eax
test eax, eax
js 0x14002ce81
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14002ce81
mov r8d, r12d
mov r9, rsi
mov edx, 1
call qword [sym.imp.msvcrt.dll_fread]
mov r11d, 0x2011
mov rcx, rbp
mov word [rdi], r11w
mov qword [rdi + 8], rbp
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
jmp 0x14002ce90
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
test ebx, ebx
cmovns ebx, r13d
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_fclose]
mov eax, ebx
jmp 0x14002cea2
mov eax, 0x80070057
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x14002cfe8
Capabilities:
Create directory
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14004b138]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edx, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edi, edi
cmp eax, edi
jne 0x14002d0c4
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
je 0x14002d0c4
call sub.KERNEL32.dll_GetLastError
cmp eax, 3
jne 0x14002d0bd
lea rax, [rsp + 0x20]
mov r8, rbx
mov edx, 0x104
sub r8, rax
lea rcx, [rsp + 0x20]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rdi
je 0x14002d072
movzx eax, word [r8 + rcx]
cmp ax, di
je 0x14002d072
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14002d04f
cmp rdx, rdi
jne 0x14002d07b
sub rcx, 2
mov word [rcx], di
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, rdi
je 0x14002d0bd
lea rcx, [rsp + 0x20]
cmp rax, rcx
je 0x14002d0bd
lea rcx, [rsp + 0x20]
mov word [rax], di
call fcn.14002cfe8
cmp eax, edi
jne 0x14002d0bd
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, edi
jne 0x14002d0c4
mov eax, 0x80004005
jmp 0x14002d0d4
mov edx, 0x2000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14003a6d0
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret