joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140067d30
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov byte [rsp + 0x37], r8b
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x570], rax
lea r14, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.1401b21d0
mov qword [rsp + 0x20], rsi
xor ebp, ebp
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.140068220
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1402eb060]
movaps xmmword [rdi], xmm0
mov rcx, r14
mov rdx, rdi
call fcn.1400683e0
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x140067dc8
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140067e9a
lea r14, [rsp + 0x58]
lea r15, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
xor r13d, r13d
mov r8d, 0x250
mov rcx, r14
mov dl, 0xaa
call fcn.1401b21d0
mov rcx, r15
mov rdx, r14
call fcn.140068390
mov edx, dword [rsp + 0x58]
test dl, 1
jne 0x140067ed7
mov rcx, r14
call fcn.140068130
test al, al
jne 0x140067f2c
cmp byte [rsp + 0x57], 0
mov rcx, rdi
jns 0x140067e36
mov rcx, qword [rsp + 0x40]
call r12
test eax, eax
jne 0x140067f25
call rbx
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r13d, r13d
cmovne ebp, r13d
mov rcx, r14
call fcn.1400248b0
mov rcx, r15
mov rdx, r14
call fcn.1400683e0
mov rcx, rdi
mov rdx, r14
call fcn.140163770
mov rcx, r14
call fcn.140163700
movzx eax, byte [rsp + 0x57]
test al, al
jns 0x140067e8e
mov rax, qword [rsp + 0x48]
mov r13d, ebp
test rax, rax
jne 0x140067def
lea rcx, [rsp + 0x40]
call fcn.140163700
lea rcx, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
call fcn.140068320
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.1401b0080
mov eax, ebp
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [rsp + 0x37], 0
je 0x140067eff
cmp byte [rsp + 0x57], 0
js 0x140067eec
lea rcx, [rsp + 0x40]
jmp 0x140067ef1
mov rcx, qword [rsp + 0x40]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140067e17
lea rcx, [rsp + 0x58]
call fcn.140068130
test al, al
jne 0x140067f13
mov edx, dword [rsp + 0x58]
jmp 0x140067ede
lea rcx, [rsp + 0x58]
call fcn.140068130
test al, al
je 0x140067e27
xor ebp, ebp
jmp 0x140067e53
xor ebp, ebp
cmp byte [rsp + 0x37], 0
je 0x140067e53
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rcx
mov rdx, rsi
mov r8b, 1
call fcn.140067d30
mov ebp, eax
test eax, eax
jne 0x140067e53
cmp byte [rsp + 0x57], 0
jns 0x140067f69
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x140067e53
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
cmp ecx, 2
cmovne ebp, eax
jmp 0x140067e53
Function at 0x140068d30
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x1402eb060]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.CreateFileVersionInfoWin
lea r8, str....._base_file_version_info_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x4d
call fcn.140162be0
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.140159400
mov dword [rsp + 0x2c], 0xaaaaaaaa
cmp byte [rbx + 0x17], 0
jns 0x140068db6
mov rbx, qword [rbx]
lea rdx, [rsp + 0x2c]
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x140068de2
mov ebp, eax
mov r14d, eax
mov rcx, r14
call fcn.1401ae97c
mov rdi, rax
lea r15, [rax + r14]
xor eax, eax
jmp 0x140068f26
mov qword [rsi], 0
jmp 0x140068ef5
mov edx, dword [rsp + 0x2c]
mov rcx, rbx
mov r8d, ebp
mov r9, rdi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140068f51
lea r8, [rsp + 0x30]
mov qword [r8], 0
lea r9, [rsp + 0x9c]
mov dword [r9], 0xaaaaaaaa
lea rdx, str.VarFileInfoTranslation
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140068f51
mov r13, qword [rsp + 0x30]
test r13, r13
je 0x140068f51
mov ecx, 0x38
call fcn.1401ae97c
mov rbx, rax
movzx r12d, word [r13]
movzx ebp, word [r13 + 2]
lea rax, fcn.140069020
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
movabs r14, 0xfffffffc00000000
mov rax, rdi
and rax, r14
cmp rax, qword [0x140370a48]
jne 0x140068e96
mov rcx, rdi
call fcn.140169950
mov qword [rbx + 0x20], rdi
mov word [rbx + 0x28], r12w
mov word [rbx + 0x2a], bp
lea r8, [rsp + 0x30]
mov qword [r8], 0
lea r9, [rsp + 0x9c]
mov dword [r9], 0xaaaaaaaa
lea rdx, [0x1403087e2]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140068f78
mov rdi, qword [rsp + 0x30]
and r14, rdi
cmp r14, qword [0x140370a48]
jne 0x140068eee
mov rcx, rdi
call fcn.140169950
mov qword [rbx + 0x30], rdi
mov qword [rsi], rbx
lea rcx, [rsp + 0x50]
call fcn.140159480
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401b0080
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
add rcx, rax
je 0x140068f3e
mov byte [rcx], 0
inc rax
cmp r14, rax
jne 0x140068f26
jmp 0x140068dee
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.1401ec0b0
mov qword [rsi], 0
test rdi, rdi
je 0x140068ef5
dec r15
cmp r15, r14
jae 0x140068f7b
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.1401ec0b0
int3
mov rcx, rdi
call fcn.1401ae9b8
jmp 0x140068ef5
Function at 0x14006a410
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0xc8], rax
test rcx, rcx
je 0x14006a5c0
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
xor r8d, r8d
call fcn.1401cf7e4
movaps xmm6, xmmword [0x1402eb060]
lea r14, [rsp + 0x80]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.ReadStreamToSpanWithMaxSize
lea r8, str....._base_files_file_util.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x48
call fcn.140162be0
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140159400
xorps xmm0, xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
mov dword [r15 + 0x30], 0
mov rcx, rbx
call fcn.1401c5dfc
mov ecx, eax
call fcn.1401c68bc
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x14006a5c4
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov r14d, 0xffff
cmovg r14, rax
cmp r14, rdi
cmovae r14, rdi
inc r14
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm6
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov r8, r14
call qword [0x14035cc68]
xor r12d, r12d
mov rcx, qword [rsp + 0x30]
add rcx, r12
mov edx, 1
mov r8, r14
mov r9, rbx
call fcn.1401cf46c
test rax, rax
je 0x14006a563
mov r15, rax
mov rax, rdi
sub rax, r12
cmp rax, r15
jb 0x14006a5cf
add r15, r12
mov rcx, rbx
call fcn.1401cecd4
test eax, eax
je 0x14006a5d3
mov r12, r15
mov rcx, rbx
call fcn.1401ced00
test eax, eax
sete bl
mov rdi, r12
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rsp + 0x20]
mov r8, rdi
call qword [0x14035cc68]
lea rcx, [rsp + 0x80]
call fcn.140159480
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1401b0080
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x14006a595
mov r14d, 0xffff
jmp 0x14006a501
xor ebx, ebx
jmp 0x14006a573
test r12, r12
mov eax, 0x10000
cmove r14, rax
lea r8, [r15 + r14]
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea r12, [rsp + 0x20]
mov rcx, r12
call qword [0x14035cc68]
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm0
mov r12, r15
jmp 0x14006a526
Function at 0x140076080
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140076150
mov eax, dword [rsi]
mov dword [0x14037095c], eax
test al, 1
jne 0x1400760a1
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x140382418]
test rcx, rcx
jne 0x1400760bb
mov rcx, qword [0x1403823f0]
test rcx, rcx
je 0x1400760df
jmp 0x140076101
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140382418], 0
mov rcx, qword [0x1403823f0]
test rcx, rcx
jne 0x140076101
and byte [0x14037095c], 0xfe
mov ecx, 0x18
call fcn.1401ae97c
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1403823f0], rax
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x140076136
call fcn.14004a8c0
cmp dword [rsi + 0x14], 0
jne 0x14007612b
mov rcx, qword [0x1403823f0]
cmp byte [rcx + 0x17], 0
jns 0x140076125
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x20
pop rsi
jmp fcn.14021a1a0
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude_string:2719:_assertion___s___nullptr_failed:_string::assign_received_nullptr_n
call fcn.1401ec0b0
int3
Function at 0x14007ab20
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1403824e0]
test rdi, rdi
jne 0x14007abd3
mov ecx, 0x50
call fcn.1401ae97c
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.1401ae97c
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x14007abf5
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x1403824e0], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14007ac08
mov rcx, rax
call fcn.1401d1e74
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.14007ac20
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401b0080
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.1401ec0b0
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude_string_view:267:_assertion___s___nullptr_failed:_null_pointer_passed_to_non_null_argument_of_char_traits_..._::length_n
call fcn.1401ec0b0
int3
Function at 0x14007ac20
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 3
call fcn.140061520
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x14007adac
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x3c], 0
lea rcx, [0x140309148]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x14007ae03
lea rdx, [0x140309198]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007adf2
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3c]
call qword [0x14035cc68]
mov rbx, rax
movsxd r12, dword [rsp + 0x3c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x30], 0
test r12, r12
je 0x14007ad42
test r12d, r12d
js 0x14007adf9
shl r12, 3
lea r15, [r12 + r12*2]
mov rcx, r15
call fcn.1401ae97c
mov r14, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
add rax, r15
mov qword [rsp + 0x30], rax
xor r15d, r15d
test r14, r14
je 0x14007adcc
mov rdx, qword [rbx + r15]
mov rcx, r14
call fcn.1401e8b40
add r14, 0x18
add r15, 8
cmp r12, r15
jne 0x14007ad1b
mov qword [rsp + 0x28], r14
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14007a700
movups xmmword [rsi], xmm6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x14007ad69
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x20]
test rsi, rsi
je 0x14007adac
mov rdi, qword [rsp + 0x28]
cmp rdi, rsi
je 0x14007ada4
add rdi, 0xffffffffffffffe8
jmp 0x14007ad97
mov rcx, qword [rdi]
call fcn.1401ae9b8
lea rax, [rdi - 0x18]
cmp rdi, rsi
mov rdi, rax
je 0x14007ada4
test rdi, rdi
je 0x14007addf
cmp byte [rdi + 0x17], 0
js 0x14007ad83
jmp 0x14007ad8b
mov rcx, rsi
call fcn.1401ae9b8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401b0080
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.1401ec0b0
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.1401ec0b0
xor ebx, ebx
jmp 0x14007accf
lea rcx, [rsp + 0x20]
call fcn.1401e8ca0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x3c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x14007accc
Function at 0x1400860a0
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rsi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rdi, [rsp + 0x40]
mov r8d, 0x200
mov rcx, rdi
mov dl, 0xaa
call fcn.1401b21d0
lea rbx, [rsp + 0x3c]
mov dword [rbx], 0x100
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
setne al
mov ecx, dword [rbx]
test rcx, rcx
setne bl
and bl, al
je 0x140086202
mov r8b, byte [rsi + 0x17]
test r8b, r8b
js 0x1400861dd
mov rdx, rsi
cmp ecx, 0xa
jbe 0x140086192
movzx edx, r8b
mov eax, r8d
cmp rdx, rcx
cmova rcx, rdx
mov r9d, 0xa
mov edx, 0xa
cmp rcx, 0xb
jb 0x14008614e
mov rdx, rcx
and rdx, 0xfffffffffffffffc
add rdx, 4
or rcx, 3
cmp rcx, 0xb
cmove rcx, rdx
mov rdx, rcx
test r8b, r8b
js 0x14008620f
cmp rdx, r9
je 0x140086167
mov rcx, rsi
call fcn.140042ac0
mov al, byte [rsi + 0x17]
mov rdx, rsi
test al, al
jns 0x140086192
mov rax, qword [rsi + 0x10]
mov rcx, rax
btr rcx, 0x3f
cmp rcx, 1
je 0x140086227
shr rax, 0x38
mov rdx, rsi
test al, al
jns 0x140086192
mov rdx, qword [rsi]
mov word [rdx], 0x2e
cmp byte [rsi + 0x17], 0
jns 0x140086209
mov qword [rsi + 8], 1
mov word [rdx + 2], 0
mov r8d, dword [rsp + 0x3c]
dec r8d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140150ca0
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401b0080
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsi + 0x10]
mov rdx, rax
btr rdx, 0x3f
dec rdx
shr rax, 0x38
cmp rdx, rcx
jae 0x140086167
mov rdx, qword [rsi + 8]
jmp 0x14008611c
call fcn.14021cec0
jmp 0x1400861c0
mov byte [rsi + 0x17], 1
jmp 0x1400861a5
mov rax, qword [rsi + 0x10]
mov r9, rax
btr r9, 0x3f
dec r9
shr rax, 0x38
jmp 0x140086157
mov r9, qword [rsi + 8]
mov r8d, 2
sub r8, rcx
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rdi
mov rcx, rsi
xor edx, edx
call fcn.140142d30
mov qword [rsi + 8], rdi
mov al, byte [rsi + 0x17]
jmp 0x140086188
Function at 0x14008eee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rsi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov ecx, edx
call fcn.140222f50
mov ebx, eax
mov dword [rsp + 0x5c], eax
mov rcx, qword [0x1403825d8]
test rcx, rcx
je 0x14008ef61
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov rdx, rsi
mov r8d, ebx
call qword [0x14035cc68]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1401b0080
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140222fc0
mov rdi, rax
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x50], rax
movsxd r15, ebx
mov rcx, r15
sar rcx, 0x3f
add r15, rax
adc rcx, 0
mov eax, ecx
and eax, 1
neg rax
xor rcx, rax
jne 0x14008f16f
test rax, rax
js 0x14008f16f
mov rax, r15
shr rax, 0x20
jne 0x14008f16f
mov dword [rsp + 0x4c], r15d
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0
mov eax, r15d
shr eax, 4
inc eax
movzx edx, ax
lea rcx, [0x140000000]
mov r8d, 6
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14008f070
mov r14, rax
lea rcx, [0x140000000]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14008f070
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14008f070
mov rbx, rax
lea rcx, [0x140000000]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x34], eax
mov eax, eax
and r15d, 0xf
jne 0x14008f12f
mov rcx, rbx
xor edx, edx
sub rax, 2
setae r9b
jb 0x14008f070
test rcx, rcx
je 0x14008f070
movzx r8d, word [rcx]
test r8, r8
je 0x14008f118
lea r10d, [r8 + r8]
cmp r10, rax
jbe 0x14008f15b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x24]
mov dword [rcx], eax
call fcn.1401429e0
lea rcx, [rsp + 0x5c]
call fcn.1401429e0
lea rcx, [rsp + 0x50]
call fcn.1401429e0
lea rcx, [rsp + 0x4c]
call fcn.1401429e0
lea rcx, [rsp + 0x28]
call fcn.1401429e0
lea rcx, [rsp + 0x40]
call fcn.1401429e0
lea rcx, [rsp + 0x38]
call fcn.1401429e0
lea rcx, [rsp + 0x34]
call fcn.1401429e0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
cmp byte [rdi + 0x2f], 0
js 0x14008f0e1
add rdi, 0x18
jmp 0x14008f0e5
mov rdi, qword [rdi + 0x18]
lea rbx, [rsp + 0x60]
mov r8d, 0x10
mov rcx, rbx
mov rdx, rdi
call fcn.14015d770
mov rcx, rbx
call fcn.1401429e0
call fcn.14021cec0
movups xmmword [rsi], xmm6
mov qword [rsi + 0x10], 0
jmp 0x14008ef37
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14008f10b
mov rax, rdx
mov rbx, rcx
dec r15d
je 0x14008f045
mov rdx, rax
xor ecx, ecx
sub rax, 2
setae cl
lea rcx, [rbx + rcx*2]
cmovae rdx, rax
jb 0x14008f120
test rbx, rbx
je 0x14008f120
movzx r8d, word [rbx]
add r8d, r8d
sub rax, r8
jb 0x14008f120
add rcx, r8
jmp 0x14008f123
mov dl, r9b
lea rdx, [rcx + rdx*2]
mov rcx, rsi
call fcn.140036040
jmp 0x14008ef37
int3
Function at 0x1400910c0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm6
mov edi, edx
mov rsi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x238], rax
movabs rbx, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x10], rbx
movaps xmm6, xmmword [0x1402eb060]
movups xmmword [rcx], xmm6
call fcn.140163550
mov ecx, edi
mov rdx, rsi
call fcn.140069120
test al, al
je 0x140091137
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x140091122
mov rax, qword [rsi + 8]
test rax, rax
je 0x140091137
mov rcx, rsi
call fcn.140066480
test al, al
jne 0x140091224
mov rcx, rsi
call fcn.140163700
lea r14, [0x14030d7b0]
mov ecx, 3
mov rax, rcx
jmp 0x140091166
not rax
add rax, rcx
lea r14, [r14 + rdx*8]
add r14, 0x18
mov rcx, rax
test rax, rax
je 0x140091175
shr rax, 1
lea rdx, [rax + rax*2]
cmp dword [r14 + rdx*8], edi
jge 0x14009115e
jmp 0x140091150
lea rax, str.PROGRAMFILES
cmp r14, rax
je 0x14009121c
cmp dword [r14], edi
jg 0x14009121c
lea rdi, [rsp + 0x32]
mov r8d, 0x206
mov rcx, rdi
mov dl, 0xaa
call fcn.1401b21d0
mov word [rdi - 2], 0
mov rcx, qword [r14 + 8]
lea rdi, [rsp + 0x30]
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
ja 0x14009121c
mov qword [rsi + 0x10], rbx
movups xmmword [rsi], xmm6
lea rbx, [rsp + 0x20]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.1401d1e74
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.1401635d0
mov rcx, rsi
call fcn.1400796d0
test al, al
je 0x140091214
mov rcx, rsi
call fcn.140165a90
test al, al
jne 0x140091214
mov rcx, rsi
call fcn.140066480
test al, al
jne 0x140091224
mov rcx, rsi
call fcn.140163700
mov rcx, rsi
call fcn.140163550
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.1401b0080
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400b25e0
Capabilities:
Initialize winhttp library

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x158
mov rsi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x150], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [0x1402eb060]
movups xmmword [rcx], xmm0
mov dword [rsp + 0x20], 0x10000000
mov rcx, rdx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdi, rax
lea rax, [0x1402ef3b8]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov byte [rsi + 0x10], 0
test rdi, rdi
je 0x1400b2762
lea rbx, [rsp + 0x40]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call fcn.1401b21d0
mov dword [rbx - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
movabs rcx, 0x100000006
mov qword [rbx - 8], rcx
mov word [rbx + 0x108], 0
lea rcx, [rsp + 0x34]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1400b2762
lea rbx, [rsp + 0x40]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call fcn.1401b21d0
mov dword [rbx - 0xc], 0x11c
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
movabs rcx, 0x300000006
mov qword [rbx - 8], rcx
mov word [rbx + 0x108], 0
lea rcx, [rsp + 0x34]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x1400b2762
lea r8, [rsp + 0x34]
mov dword [r8], 0xa80
mov rcx, rdi
mov edx, 0x54
mov r9d, 4
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401b0080
mov rax, rsi
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop r14
ret