joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400df290
Capabilities:
Get token membership

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov eax, dword [0x1401763a0]
mov qword [rsp + 0x40], 0
mov rdi, rcx
mov ebx, r8d
test eax, eax
je 0x1400df2d0
test eax, r8d
setne byte [rcx]
xor esi, esi
mov eax, esi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rcx, [rsp + 0x40]
xor r13d, r13d
call fcn.1400b6c10
mov r12, qword [rsp + 0x40]
mov rbp, qword [0x14019f130]
mov esi, eax
test eax, eax
js 0x1400df3bd
test bl, 1
je 0x1400df3d0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x3c], 0
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
lea r8, [rsp + 0x48]
mov edx, 8
mov rcx, rax
call qword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x1400df440
lea r13, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], r13
mov rsi, qword [sym.imp.advapi32.dll_GetTokenInformation]
mov edx, 1
call rsi
test eax, eax
jne 0x1400df364
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400df480
lea rdx, str.could_not_lookup_token_metadata
mov ecx, 2
call fcn.1400da2e0
mov rbp, qword [0x14019f130]
xor r14d, r14d
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400df428
xor r13d, r13d
mov esi, 0xffffffff
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, r14
call qword [rbp + 0x10]
cmp esi, 0xffffffff
je 0x1400df3bd
mov rdx, r13
mov rcx, r12
call qword [sym.imp.advapi32.dll_EqualSid]
mov esi, eax
test eax, eax
je 0x1400df3da
mov byte [rdi], 1
xor esi, esi
mov rcx, r12
call qword [rbp + 0x10]
mov rcx, r13
call qword [rbp + 0x10]
jmp 0x1400df2bf
mov rbp, qword [0x14019f130]
xor r13d, r13d
mov r14, qword [sym.imp.advapi32.dll_IsWellKnownSid]
mov edx, 0x1a
mov rcx, r12
call r14
test eax, eax
je 0x1400df410
mov r14d, 1
test bl, 2
jne 0x1400df403
and ebx, 4
jne 0x1400df460
xor r14d, r14d
mov byte [rdi], r14b
jmp 0x1400df3bd
mov edx, 0x16
mov rcx, r12
call r14
test eax, eax
jne 0x1400df3f0
jmp 0x1400df400
mov rcx, r14
call qword [rbp + 0x10]
xor r13d, r13d
mov esi, 0xffffffff
jmp 0x1400df3bd
lea rdx, str.could_not_lookup_process_information
mov ecx, 2
call fcn.1400da2e0
jmp 0x1400df375
xor ecx, ecx
lea r8, [rsp + 0x48]
mov rdx, r12
call qword [sym.imp.advapi32.dll_CheckTokenMembership]
test eax, eax
je 0x1400df400
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x1400df400
jmp 0x1400df403
mov rbp, qword [0x14019f130]
mov ecx, dword [rsp + 0x3c]
mov r8d, 0x13
lea rdx, [0x14018eb90]
call qword [rbp]
mov r14, rax
test rax, rax
je 0x1400df4fa
mov qword [rsp + 0x20], r13
mov r9d, dword [rsp + 0x3c]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x48]
call rsi
test eax, eax
je 0x1400df4e4
mov rcx, qword [r14]
call fcn.140162ec0
mov rcx, qword [rsp + 0x48]
cmp rax, 1
mov r13, rax
sbb esi, esi
test rcx, rcx
jne 0x1400df395
jmp 0x1400df39b
lea rdx, str.could_not_lookup_current_user
mov ecx, 2
call fcn.1400da2e0
jmp 0x1400df37f
call fcn.1400da310
jmp 0x1400df42e
Function at 0x1400e2f20
Capabilities:
Initialize hashing via wincrypt

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x960]
cmp eax, 1
je 0x1400e2f50
cmp eax, 2
je 0x1400e2f60
lea rdx, str.unknown_hash_algorithm
mov ecx, 0x23
call fcn.1400da2e0
mov eax, 0xffffffff
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x1400e3020
add rsp, 0x28
jmp 0x1400e3450
sub rsp, 0x28
test rcx, rcx
je 0x1400e3035
call fcn.14008b550
xor eax, eax
add rsp, 0x28
ret
lea r9, [0x140193570]
lea r8, [0x140193574]
mov ecx, 3
lea rdx, [0x140193585]
call fcn.1400da2e0
mov eax, 0xffffffff
jmp 0x1400e3030
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
je 0x1400e34e5
cmp dword [0x1401760a0], 2
movzx eax, byte [rcx + 8]
je 0x1400e34b0
test al, al
jne 0x1400e34a0
lea rax, [rbx + 0x10]
mov edx, dword [rbx]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, qword [0x1401760a8]
call qword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
je 0x1400e350b
mov byte [rbx + 8], 1
xor eax, eax
add rsp, 0x50
pop rbx
ret
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.advapi32.dll_CryptDestroyHash]
jmp 0x1400e3472
cmp dword [rcx], 0x800c
mov r8d, 0x14
mov edx, 0x20
cmove r8d, edx
test al, al
je 0x1400e3498
xor r9d, r9d
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x30]
call qword [0x1401760c8]
test eax, eax
js 0x1400e3522
mov byte [rbx + 8], 0
jmp 0x1400e3498
lea r9, [0x14019379c]
lea r8, [0x1401937a0]
mov ecx, 3
lea rdx, [0x1401937b1]
call fcn.1400da2e0
mov eax, 0xffffffff
jmp 0x1400e349a
mov byte [rbx + 8], 0
lea rdx, str.legacy_hash_implementation_could_not_be_created
mov ecx, 2
call fcn.1400da2e0
jmp 0x1400e3504
lea rdx, str.hash_implementation_could_not_be_finished
mov ecx, 2
call fcn.1400da2e0
jmp 0x1400e3504
Function at 0x1400e3110
Capabilities:
Initialize hashing via wincrypt

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
test rcx, rcx
je 0x1400e3221
mov eax, dword [0x1401760a0]
test eax, eax
je 0x1400e3200
pxor xmm0, xmm0
movups xmmword [rcx], xmm0
cmp dword [0x1401760a0], 2
movups xmmword [rcx + 0x10], xmm0
je 0x1400e3180
lea rax, [rcx + 0x10]
mov dword [rcx], 0x800c
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, qword [0x1401760a8]
mov edx, 0x800c
call qword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
je 0x1400e3242
mov byte [rbx + 8], 1
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
mov rsi, qword [0x14019f130]
mov r8d, 0x13
mov ecx, dword [0x140176100]
lea rdx, [0x1401937cd]
call qword [rsi]
mov r8, rax
test rax, rax
je 0x1400e31e8
mov qword [rbx + 0x18], rax
mov r9d, dword [0x140176100]
lea rdx, [rbx + 0x10]
mov dword [rsp + 0x30], 0
mov rcx, qword [0x1401760f8]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [0x1401760c0]
test eax, eax
js 0x1400e3259
mov dword [rbx], 0x800c
jmp 0x1400e3177
call fcn.1400da310
mov qword [rbx + 0x18], 0
mov eax, 0xffffffff
jmp 0x1400e3179
lea r9, str.hash_provider.type
lea r8, [0x1401937a0]
mov ecx, 3
lea rdx, [0x1401937b1]
call fcn.1400da2e0
jmp 0x1400e31f5
lea r9, [0x14019379c]
lea r8, [0x1401937a0]
mov ecx, 3
lea rdx, [0x1401937b1]
call fcn.1400da2e0
jmp 0x1400e31f5
mov byte [rbx + 8], 0
lea rdx, str.legacy_hash_implementation_could_not_be_created
mov ecx, 2
call fcn.1400da2e0
jmp 0x1400e31f5
mov rcx, qword [rbx + 0x18]
call qword [rsi + 0x10]
lea rdx, str.sha256_implementation_could_not_be_created
mov ecx, 2
call fcn.1400da2e0
jmp 0x1400e31f5

Function at 0x1400e33c0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
sub rsp, 0x38
mov edx, dword [0x1401760a0]
xor eax, eax
test edx, edx
je 0x1400e33d8
add rsp, 0x38
ret
call fcn.1400a26b0
test eax, eax
js 0x1400e33f8
jne 0x1400e33d0
lea rcx, [fcn.14012ca90]
add rsp, 0x38
jmp fcn.1401170a0
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
lea rcx, [0x1401760a8]
call qword [sym.imp.advapi32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400e3436
lea rcx, [fcn.14012ca90]
mov dword [0x1401760a0], 1
add rsp, 0x38
jmp fcn.1401170a0
lea rdx, str.legacy_hash_context_could_not_be_started
mov ecx, 2
call fcn.1400da2e0
or eax, 0xffffffff
jmp 0x1400e33d0
Function at 0x1400e3450
Capabilities:
Initialize hashing via wincrypt

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x960]
cmp eax, 1
je 0x1400e2f50
cmp eax, 2
je 0x1400e2f60
lea rdx, str.unknown_hash_algorithm
mov ecx, 0x23
call fcn.1400da2e0
mov eax, 0xffffffff
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x1400e3020
add rsp, 0x28
jmp 0x1400e3450
sub rsp, 0x28
test rcx, rcx
je 0x1400e3035
call fcn.14008b550
xor eax, eax
add rsp, 0x28
ret
lea r9, [0x140193570]
lea r8, [0x140193574]
mov ecx, 3
lea rdx, [0x140193585]
call fcn.1400da2e0
mov eax, 0xffffffff
jmp 0x1400e3030
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
je 0x1400e34e5
cmp dword [0x1401760a0], 2
movzx eax, byte [rcx + 8]
je 0x1400e34b0
test al, al
jne 0x1400e34a0
lea rax, [rbx + 0x10]
mov edx, dword [rbx]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, qword [0x1401760a8]
call qword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
je 0x1400e350b
mov byte [rbx + 8], 1
xor eax, eax
add rsp, 0x50
pop rbx
ret
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.advapi32.dll_CryptDestroyHash]
jmp 0x1400e3472
cmp dword [rcx], 0x800c
mov r8d, 0x14
mov edx, 0x20
cmove r8d, edx
test al, al
je 0x1400e3498
xor r9d, r9d
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x30]
call qword [0x1401760c8]
test eax, eax
js 0x1400e3522
mov byte [rbx + 8], 0
jmp 0x1400e3498
lea r9, [0x14019379c]
lea r8, [0x1401937a0]
mov ecx, 3
lea rdx, [0x1401937b1]
call fcn.1400da2e0
mov eax, 0xffffffff
jmp 0x1400e349a
mov byte [rbx + 8], 0
lea rdx, str.legacy_hash_implementation_could_not_be_created
mov ecx, 2
call fcn.1400da2e0
jmp 0x1400e3504
lea rdx, str.hash_implementation_could_not_be_finished
mov ecx, 2
call fcn.1400da2e0
jmp 0x1400e3504

Function at 0x1400e3540
Capabilities:
Hash data via wincrypt

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, rcx
mov rdi, rdx
mov rbx, r8
test rcx, rcx
je 0x1400e361e
cmp dword [0x1401760a0], 2
je 0x1400e35d0
cmp byte [rcx + 8], 0
je 0x1400e3642
mov r12, qword [sym.imp.advapi32.dll_CryptHashData]
test r8, r8
jne 0x1400e3588
jmp 0x1400e35c0
add rdi, rsi
sub rbx, rsi
je 0x1400e35c0
mov esi, 0xffffffff
mov rcx, qword [rbp + 0x10]
mov rdx, rdi
cmp rbx, rsi
cmovbe rsi, rbx
xor r9d, r9d
mov r8d, esi
call r12
test eax, eax
jne 0x1400e3580
lea rdx, str.legacy_hash_data_could_not_be_updated
mov ecx, 2
call fcn.1400da2e0
mov eax, 0xffffffff
jmp 0x1400e35c2
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test r8, r8
jne 0x1400e35e8
jmp 0x1400e35c0
add rdi, rsi
sub rbx, rsi
je 0x1400e35c0
mov esi, 0xffffffff
mov rcx, qword [rbp + 0x10]
mov rdx, rdi
cmp rbx, rsi
cmovbe rsi, rbx
xor r9d, r9d
mov r8d, esi
call qword [0x1401760d0]
test eax, eax
jns 0x1400e35e0
lea rdx, str.hash_could_not_be_updated
mov ecx, 2
call fcn.1400da2e0
jmp 0x1400e35b9
lea r9, [0x14019379c]
lea r8, [0x1401937a0]
mov ecx, 3
lea rdx, [0x1401937b1]
call fcn.1400da2e0
jmp 0x1400e35b9
lea r9, str.ctx__ctx.cryptoapi.valid
lea r8, [0x1401938a5]
mov ecx, 0x23
lea rdx, [0x1401937b1]
call fcn.1400da2e0
jmp 0x1400e35b9
Function at 0x1400e3670
Capabilities:
Hash data via wincrypt

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x960]
cmp eax, 1
je 0x1400e36a0
cmp eax, 2
je 0x1400e36b0
lea rdx, str.unknown_hash_algorithm
mov ecx, 0x23
call fcn.1400da2e0
mov eax, 0xffffffff
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.1400e3060
add rsp, 0x28
jmp fcn.1400e3540
Function at 0x140110d20
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xaa8
xor eax, eax
pxor xmm0, xmm0
lea rsi, [rsp + 0x80]
mov rbx, rcx
mov ecx, 0x143
mov rbp, rdx
mov rdi, rsi
movups xmmword [rsp + 0x38], xmm0
rep stosq qword [rdi], rax
mov rax, qword [0x14019f380]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x140110eb7
cmp dword [rbx + 0xbc], 1
je 0x140110db0
lea r9, [0x14018c82a]
lea r8, [0x14018c1e1]
mov ecx, 0x23
lea rdx, [0x14018c00c]
call fcn.1400da2e0
mov edi, 0xffffffff
mov eax, edi
add rsp, 0xaa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x30]
mov r8, qword [rbx + 0x70]
mov edx, 0x2f
lea r9, [0x14018c277]
mov rcx, rax
mov qword [rsp + 0x28], rax
call fcn.14011c9f0
mov edi, eax
test eax, eax
js 0x140110e8d
mov rdx, qword [rsp + 0x30]
mov r9d, 0x1b6
mov r8d, 1
mov rcx, rsi
call fcn.1400db7f0
mov edi, eax
test eax, eax
js 0x140110e8d
cmp qword [rbp + 8], 0
je 0x140110e70
xor r15d, r15d
xor r12d, r12d
lea rdi, [rsp + 0x50]
xor r14d, r14d
mov r13d, 0x28
nop word [rax + rax]
mov r8, qword [rbp]
mov edx, 0x29
mov rcx, rdi
add r8, r15
call fcn.1400fc460
mov r8, r13
mov rdx, rdi
mov rcx, rsi
cmp dword [rbx + 0xbc], 1
cmovne r8, r14
add r12, 1
add r15, 0x14
call fcn.1400dc150
mov r8d, 1
lea rdx, [0x14018c837]
mov rcx, rsi
call fcn.1400dc150
cmp r12, qword [rbp + 8]
jb 0x140110e20
mov rcx, rsi
call fcn.1400db480
mov rcx, rbx
call fcn.14013f420
mov edi, eax
test eax, eax
js 0x140110eb0
cmp qword [rbp + 8], 0
je 0x140110ea0
mov rcx, qword [rsp + 0x28]
call fcn.14011c2b0
jmp 0x140110d99
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_remove
jmp 0x140110e8d
mov edi, 0xffffffff
jmp 0x140110e8d
lea r9, [0x14018c0c9]
lea r8, [0x14018bffb]
mov ecx, 3
lea rdx, [0x14018c00c]
call fcn.1400da2e0
jmp 0x140110d94

Function at 0x140123fc0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rcx + 0x10], r8
mov rbx, rcx
mov r9, rcx
lea r8, [0x140129450]
mov qword [rcx + 8], rdx
xor edx, edx
mov qword [rcx + 0x18], 0
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_CreateThread]
cmp rax, 1
mov qword [rbx], rax
sbb eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140129340
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rdi
mov eax, 0x2030
push rsi
push rbx
call fcn.140083330
sub rsp, rax
lea rdi, [rsp + 0x20]
mov rbx, rcx
mov esi, edx
mov rdx, rcx
mov rcx, rdi
call fcn.140129cf0
test eax, eax
js 0x1401293d6
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401293d6
mov ecx, eax
mov edx, eax
or ecx, 2
and edx, 0xfffffffd
test sil, sil
cmovne edx, ecx
cmp edx, eax
jne 0x1401293a0
xor eax, eax
add rsp, 0x2030
pop rbx
pop rsi
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
jne 0x14012938b
test sil, sil
lea r8, str.unset
mov r9, rbx
mov ecx, 2
lea rax, [0x140193500]
lea rdx, str.failed_to__s_hidden_bit_for__s
cmovne r8, rax
call fcn.1400da2e0
mov eax, 0xffffffff
jmp 0x14012938d
Function at 0x140129a40
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rbp, str.PATH
mov rdi, rcx
mov rcx, rdx
mov qword [rsp + 0x98], rdx
call sub.msvcrt.dll_wcslen
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov rsi, qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov r12, rax
call rsi
mov ebx, eax
test eax, eax
jne 0x140129abc
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xcb
jne 0x140129cdd
mov rax, qword [0x14019f130]
xor ecx, ecx
call qword [rax + 0x10]
xor eax, eax
mov word [rdi], ax
mov eax, 0xfffffffd
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, eax
mov rax, qword [0x14019f130]
mov r8d, 0x13
lea rdx, [0x140193074]
add rcx, rcx
call qword [rax]
mov qword [rsp + 0x38], rax
mov r15, rax
test rax, rax
je 0x140129c97
mov r8d, ebx
mov rdx, rax
mov rcx, rbp
call rsi
test eax, eax
je 0x140129cdd
lea rax, [r12 + r12]
mov qword [rsp + 0x28], rax
nop dword [rax]
movzx eax, word [r15]
test ax, ax
je 0x140129cb0
cmp ax, 0x22
je 0x140129c70
test r12, r12
mov edx, 0x3b
setne cl
xor r8d, r8d
mov rbx, r15
xor esi, esi
jmp 0x140129b49
movzx eax, word [rbx + 2]
add rbx, 2
add rsi, 1
test ax, ax
je 0x140129b59
cmp ax, dx
jne 0x140129b38
lea rax, [rbx + 2]
test r8b, r8b
cmovne rbx, rax
test rsi, rsi
lea rbp, [r12 + rsi]
setne al
and eax, ecx
cmp word [rbx], 0x3b
mov edx, eax
lea rax, [rbx + 2]
jne 0x140129b86
nop dword [rax]
mov rbx, rax
add rax, 2
cmp word [rax - 2], 0x3b
je 0x140129b78
test dl, dl
je 0x140129c48
lea r13, [rsi + rsi]
xor r14d, r14d
movzx r10d, word [r15 + r13 - 2]
cmp r10w, 0x5c
setne r14b
add rbp, r14
cmp rbp, 0x104
ja 0x140129cc4
mov r8, r13
mov rdx, r15
mov rcx, rdi
mov dword [rsp + 0x34], r10d
call sub.msvcrt.dll_memmove
mov r10d, dword [rsp + 0x34]
cmp r10w, 0x5c
je 0x140129bdd
mov ecx, 0x5c
mov word [rdi + r13], cx
lea r11, [r14 + rsi]
mov r15, rbx
lea rsi, [r11 + r11]
lea rbp, [r12 + r11]
nop dword [rax]
mov rdx, qword [rsp + 0x98]
mov r8, qword [rsp + 0x28]
lea rcx, [rdi + rsi]
call sub.msvcrt.dll_memcpy
xor edx, edx
mov rcx, rdi
mov word [rdi + rbp*2], dx
xor edx, edx
call qword [sym.imp.msvcrt.dll__waccess]
test eax, eax
jne 0x140129b08
mov dword [rsp + 0x28], eax
mov rax, qword [0x14019f130]
mov rcx, qword [rsp + 0x38]
call qword [rax + 0x10]
mov eax, dword [rsp + 0x28]
jmp 0x140129aab
mov rbp, r12
mov r15, rbx
xor esi, esi
nop dword [rax + rax]
cmp rbp, 0x104
ja 0x140129cc4
add rsi, rsi
mov rdx, r15
mov rcx, rdi
mov r15, rbx
mov r8, rsi
call sub.msvcrt.dll_memmove
jmp 0x140129bf0
movzx eax, word [r15 + 2]
test r12, r12
lea rbx, [r15 + 2]
setne cl
test ax, ax
je 0x140129c3b
mov edx, 0x22
mov r15, rbx
mov r8d, 1
jmp 0x140129b2d
call fcn.1400da310
mov eax, 0xffffffff
jmp 0x140129aab
mov rax, qword [0x14019f130]
mov rcx, qword [rsp + 0x38]
call qword [rax + 0x10]
jmp 0x140129aa1
lea rdx, str.path_too_long
mov ecx, 3
mov r15, rbx
call fcn.1400da2e0
jmp 0x140129b08
lea rdx, str.could_not_load_PATH
mov ecx, 2
call fcn.1400da2e0
jmp 0x140129c9c
Function at 0x14012a1a0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
movzx ecx, byte [rdx]
mov eax, ecx
and eax, 0xffffffdf
sub eax, 0x41
cmp al, 0x19
ja 0x14012a208
cmp byte [rdx + 1], 0x3a
je 0x14012a220
cmp cl, 0x5c
je 0x14012a20d
mov r8, rdx
mov rcx, rbx
mov edx, 0x1000
call fcn.140127d50
test eax, eax
js 0x14012a235
movsxd rdx, eax
lea rdx, [rbx + rdx*2]
cmp rbx, rdx
jae 0x14012a1ff
nop word [rax + rax]
cmp word [rbx], 0x2f
jne 0x14012a1f6
mov ecx, 0x5c
mov word [rbx], cx
add rbx, 2
cmp rbx, rdx
jb 0x14012a1e8
add rsp, 0x20
pop rbx
ret
cmp cl, 0x5c
jne 0x14012a22e
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140129cf0
movzx eax, byte [rdx + 2]
cmp al, 0x5c
je 0x14012a20d
cmp al, 0x2f
jne 0x14012a1c2
jmp 0x14012a20d
cmp cl, 0x2f
jne 0x14012a1c2
jmp 0x14012a20d
mov eax, 0xffffffff
jmp 0x14012a1ff
Function at 0x140140be0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov r9d, 0x20019
lea rax, [rsp + 0x38]
mov rbx, rcx
mov dword [rsp + 0x34], 0x4016
mov rcx, rdx
mov qword [rsp + 0x20], rax
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140140cb0
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rdx, str.InstallLocation
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x140140c60
mov ebx, 0xfffffffd
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop rbx
ret
cmp dword [rsp + 0x30], 1
jne 0x140140c44
mov eax, dword [rsp + 0x34]
lea edx, [rax - 1]
cmp edx, 0x200a
ja 0x140140c44
shr eax, 1
lea rdx, [rbx + rax*2 - 2]
cmp word [rdx], 0
jne 0x140140cc0
lea rdx, [rbx + rax*2 - 4]
cmp word [rdx], 0x5c
jne 0x140140c93
xor eax, eax
mov word [rdx], ax
mov rcx, rbx
xor edx, edx
call qword [sym.imp.msvcrt.dll__waccess]
mov ebx, eax
test eax, eax
jne 0x140140c44
jmp 0x140140c49
mov ebx, 0xfffffffd
jmp 0x140140c54
xor ecx, ecx
mov word [rbx + rax*2], cx
jmp 0x140140c88

Function at 0x140142360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rdi, [rsp + 0x20]
mov rsi, rdx
mov ebp, r8d
xor edx, edx
mov rbx, rcx
mov r8, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesExW]
test eax, eax
je 0x1401423a3
xor eax, eax
test rsi, rsi
je 0x14014239a
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.140128d80
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x1401423d0
call rdi
mov dword [rax], 2
call rdi
cmp dword [rax], 2
jne 0x1401423c9
test bpl, bpl
jne 0x1401423da
mov eax, 0xffffffff
jmp 0x14014239a
call rdi
mov dword [rax], 0xd
jmp 0x1401423bd
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov rsi, rax
sub rsi, 1
je 0x1401423c9
lea rax, [rbx + rsi*2]
jmp 0x140142408
cmp dx, 0x5c
je 0x140142411
sub rax, 2
sub rsi, 1
je 0x1401423c9
movzx edx, word [rax]
cmp dx, 0x2f
jne 0x1401423f8
xor edx, edx
mov rcx, rbx
mov word [rax], dx
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401423e5
test al, 0x10
jne 0x1401423c9
call rdi
mov dword [rax], 0x14
jmp 0x1401423c9
Function at 0x14014c4b0
Capabilities:
Timestomp file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0
mov ebx, ecx
mov qword [rsp + 0x28], 0
test rdx, rdx
je 0x14014c548
imul rcx, qword [rdx], 0x989680
movsxd rax, dword [rdx + 8]
imul r8, qword [rdx + 0x10], 0x989680
lea rax, [rax + rax*4]
lea rax, [rcx + rax*2]
movabs rcx, 0x19db1ded53e8000
add rax, rcx
mov qword [rsp + 0x20], rax
movsxd rax, dword [rdx + 0x18]
lea rax, [rax + rax*4]
lea rax, [r8 + rax*2]
add rax, rcx
mov qword [rsp + 0x28], rax
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x14014c578
xor edx, edx
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_SetFileTime]
cmp eax, 1
sbb eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetSystemTime]
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov rdi, qword [sym.imp.kernel32.dll_SystemTimeToFileTime]
call rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call rdi
jmp 0x14014c511
mov eax, 0xffffffff
jmp 0x14014c539

Function at 0x14014c890
Capabilities:
Create directory

Disassembly:
push rbx
mov eax, 0x2030
call fcn.140083330
sub rsp, rax
lea rbx, [rsp + 0x20]
mov rdx, rcx
mov rcx, rbx
call fcn.140129cf0
test eax, eax
js 0x14014c8c8
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wmkdir]
add rsp, 0x2030
pop rbx
ret
mov eax, 0xffffffff
jmp 0x14014c8bb
Function at 0x14014c8d0
Capabilities:
Get system information on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rdi, qword [rsp + 0xc8]
mov rbx, rcx
mov r12, rdx
mov ecx, dword [rsp + 0xc0]
mov ebp, r8d
mov esi, r9d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r13, rax
mov eax, dword [0x140176080]
test eax, eax
je 0x14014ca10
test rbx, rbx
je 0x14014ca94
test r12, r12
je 0x14014ca94
test bpl, 3
je 0x14014ca73
and esi, 0x10
jne 0x14014cab5
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
cmp r13, 0xffffffffffffffff
je 0x14014cad9
mov edx, ebp
and edx, 1
and ebp, 2
jne 0x14014c9f8
lea r8d, [rdx + rdx]
xor ebp, ebp
mov ecx, ebp
or ecx, 4
test edx, edx
cmovne ebp, ecx
mov ecx, eax
mov rax, rdi
cqo
idiv rcx
mov rax, rdi
sub rax, rdx
cmp rdi, rax
jne 0x14014ca30
mov rcx, r13
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
call qword [sym.imp.kernel32.dll_CreateFileMappingA]
mov qword [rbx + 0x10], rax
mov rcx, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14014ca58
mov r9d, edi
shr rdi, 0x20
mov qword [rsp + 0x20], r12
mov edx, ebp
mov r8, rdi
call qword [sym.imp.kernel32.dll_MapViewOfFile]
mov qword [rbx], rax
test rax, rax
je 0x14014cafb
mov qword [rbx + 8], r12
mov eax, esi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, 4
mov ebp, 2
jmp 0x14014c968
lea rcx, [rsp + 0x30]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x58]
mov dword [0x140176080], eax
jmp 0x14014c90e
call qword [sym.imp.msvcrt.dll__errno]
lea rdx, str.failed_to_mmap._Offset_must_be_multiple_of_allocation_granularity
mov ecx, 2
mov dword [rax], 0x16
call fcn.1400da2e0
mov esi, 0xffffffff
jmp 0x14014c9e6
lea rdx, str.failed_to_mmap._Invalid_handle_value
mov ecx, 2
call fcn.1400da2e0
mov qword [rbx + 0x10], 0
jmp 0x14014ca4d
lea r9, str._prot__0x2____prot__0x1_
lea r8, [0x140192efe]
mov ecx, 0x23
lea rdx, [0x140192f1b]
call fcn.1400da2e0
jmp 0x14014ca4d
lea r9, str.out_____void__0___len___0
lea r8, [0x140192efe]
mov ecx, 0x23
lea rdx, [0x140192f1b]
call fcn.1400da2e0
jmp 0x14014ca4d
lea r9, str._flags__0x10___0
lea r8, [0x140192efe]
mov ecx, 0x23
lea rdx, [0x140192f1b]
call fcn.1400da2e0
jmp 0x14014ca4d
call qword [sym.imp.msvcrt.dll__errno]
lea rdx, str.failed_to_mmap._Invalid_handle_value
mov ecx, 2
mov dword [rax], 9
call fcn.1400da2e0
jmp 0x14014ca4d
lea rdx, str.failed_to_mmap._No_data_written
mov ecx, 2
call fcn.1400da2e0
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [rbx + 0x10], 0
jmp 0x14014ca4d