joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140061acc
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x1060
call fcn.1400ba8b0
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
cmp rdx, rcx
je 0x140061b0b
mov rdx, rcx
mov rcx, rbx
call fcn.14006b580
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareWinRARGeneral
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r12d, r12d
cmp eax, r12d
jne 0x140061c18
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
mov eax, 0x3ff
lea r9, [rsp + 0x40]
not rcx
lea rdx, str.LanguageFolder
xor r8d, r8d
dec rcx
sub eax, ecx
mov rcx, qword [rsp + 0x38]
add eax, eax
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x850]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x140061c0d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x850]
mov r8d, 0x400
mov word [rsp + 0x50], r12w
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0x50]
call fcn.14005254c
mov rcx, rsi
call fcn.140052abc
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
mov r11, rax
xor eax, eax
repne scasw ax, word [rdi]
xor r9d, r9d
movzx edx, word [r11 + r9]
add r9, 2
mov word [rdi + r9 - 4], dx
test dx, dx
jne 0x140061bd8
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.1400310a8
cmp al, r12b
je 0x140061c0d
lea rdx, [rsp + 0x50]
mov r8, rbp
mov rcx, rbx
call fcn.14006b580
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1400a8530
add rsp, 0x1060
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140061dec
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x950
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x940], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
call fcn.140061a98
xor ebp, ebp
cmp rbx, rbp
je 0x140061e48
lea r8, [rsp + 0x140]
sub r8, rbx
movzx eax, word [rbx]
mov word [r8 + rbx], ax
add rbx, 2
cmp ax, bp
jne 0x140061e35
jmp 0x140061e5e
lea rdx, [rsp + 0x140]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x140]
lea rbx, str.rarlng.dll
call fcn.140052abc
movzx ecx, word [rbx]
add rbx, 2
mov word [rax], cx
add rax, 2
cmp cx, bp
jne 0x140061e72
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x140]
mov r8d, 0x400
call fcn.140061acc
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x140061ee0
cmp dword [rsp + 0x24], 5
ja 0x140061eca
jne 0x140061ee0
cmp dword [rsp + 0x28], 1
jbe 0x140061ee0
xor edx, edx
lea rcx, [rsp + 0x140]
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x140061eee
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, rbp
mov qword [0x1400ec660], rax
setne cl
mov byte [rsi], cl
mov rax, qword [0x1400ec660]
cmp cl, bpl
cmove rax, rdi
mov qword [0x1400ec658], rdi
mov qword [0x1400ec660], rax
mov rcx, qword [rsp + 0x940]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0x950]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140061f44
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x20
call fcn.1400a8e30
xor r11d, r11d
xor r10d, r10d
xor edx, edx
xor r8d, r8d
xor r9d, r9d
cmp r9, 0x28
jg 0x140061fcb
cmp rdx, 4
jge 0x140061fb2
lea rbx, [rsp + rdx*4 + 0x20]
cmp r8, 4
jge 0x140061fb6
mov eax, dword [rbx]
lea rcx, [r9 + r8]
inc rdx
add rbx, 4
inc r10d
inc r8
cmp rdx, 4
mov dword [rdi + rcx*4 + 0x14], eax
jl 0x140061f8f
cmp r8, 4
jne 0x140061fc5
inc r11d
add r9, 4
xor r10d, r10d
xor r8d, r8d
cmp rdx, 4
jl 0x140061f7e
movsxd r8, r11d
movsxd r9, r10d
cmp r8, 0xa
jg 0x14006209a
lea r11, [0x14011d9f0]
lea rbx, [0x14011db10]
movzx eax, byte [rsp + 0x2d]
mov cl, byte [rsp + 0x20]
lea rdx, [rsp + 0x24]
xor cl, byte [rax + rbx]
movzx eax, byte [rsp + 0x2e]
mov r10d, 3
mov al, byte [rax + rbx]
xor cl, byte [r11]
xor byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x2f]
mov byte [rsp + 0x20], cl
mov al, byte [rax + rbx]
xor byte [rsp + 0x22], al
movzx eax, byte [rsp + 0x2c]
mov al, byte [rax + rbx]
xor byte [rsp + 0x23], al
inc r11
xor ecx, ecx
mov al, byte [rdx + rcx - 4]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jl 0x140062030
add rdx, 4
sub r10, 1
jne 0x14006202e
xor edx, edx
cmp r8, 0xa
jg 0x14006209a
cmp rdx, 4
jge 0x14006207e
lea r10, [rsp + rdx*4 + 0x20]
cmp r9, 4
jge 0x140062082
mov eax, dword [r10]
lea rcx, [r9 + r8*4]
inc rdx
add r10, 4
inc r9
cmp rdx, 4
mov dword [rdi + rcx*4 + 0x14], eax
jl 0x14006205d
cmp r9, 4
jne 0x14006208a
inc r8
xor r9d, r9d
cmp rdx, 4
jl 0x14006204c
cmp r8, 0xa
jle 0x140061fe9
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a8530
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400620b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x10], rax
lea r10, [rcx + 0x24]
mov r11d, 9
lea r13, [0x140000000]
xor r9d, r9d
lea rsi, [rsp + r9]
lea rdi, [r10 + 2]
mov ebp, 4
movzx eax, byte [rdi + 1]
lea rdx, [r9 + rax*4]
movzx eax, byte [rdi - 1]
mov r8b, byte [rdx + r13 + 0x11a9f0]
lea rcx, [r9 + rax*4]
movzx eax, byte [rdi - 2]
xor r8b, byte [rcx + r13 + 0x11b1f0]
lea rcx, [r9 + rax*4]
movzx eax, byte [rdi]
xor r8b, byte [rcx + r13 + 0x11b5f0]
lea rcx, [r9 + rax*4]
add rdi, 4
xor r8b, byte [rcx + r13 + 0x11adf0]
mov byte [rsi], r8b
add rsi, 4
sub rbp, 1
jne 0x1400620f6
inc r9
cmp r9, 4
jl 0x1400620e9
movdqu xmm0, xmmword [rsp]
movdqu xmmword [r10], xmm0
add r10, 0x10
sub r11, 1
jne 0x1400620e6
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.1400a8530
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
Function at 0x140062dec
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
jmp 0x140062dec
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, r9
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
test r8, r8
jne 0x140062e1e
xor eax, eax
jmp 0x140062ec6
mov eax, dword [rdx]
mov r8, rbx
shr rsi, 4
xor eax, dword [rcx + 4]
mov dword [rsp + 0x20], eax
mov eax, dword [rdx + 4]
xor eax, dword [rcx + 8]
mov dword [rsp + 0x24], eax
mov eax, dword [rdx + 8]
xor eax, dword [rcx + 0xc]
mov dword [rsp + 0x28], eax
mov eax, dword [rdx + 0xc]
lea rdx, [rsp + 0x20]
xor eax, dword [rcx + 0x10]
mov dword [rsp + 0x2c], eax
call fcn.140062184
lea r12, [rsi - 1]
add rbp, 0x10
test r12, r12
je 0x140062ea8
mov eax, dword [rbx]
add rbx, 0x10
lea rdx, [rsp + 0x20]
xor eax, dword [rbp]
mov r8, rbx
mov rcx, rdi
mov dword [rsp + 0x20], eax
mov eax, dword [rbx - 0xc]
xor eax, dword [rbp + 4]
mov dword [rsp + 0x24], eax
mov eax, dword [rbx - 8]
xor eax, dword [rbp + 8]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx - 4]
xor eax, dword [rbp + 0xc]
mov dword [rsp + 0x2c], eax
call fcn.140062184
add rbp, 0x10
sub r12, 1
jne 0x140062e63
mov eax, dword [rbx]
shl rsi, 4
mov dword [rdi + 4], eax
mov eax, dword [rbx + 4]
mov dword [rdi + 8], eax
mov eax, dword [rbx + 8]
mov dword [rdi + 0xc], eax
mov eax, dword [rbx + 0xc]
mov dword [rdi + 0x10], eax
mov rax, rsi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a8530
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140062ee0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
jmp 0x140062ee0
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x140062fe6
test rbx, rbx
je 0x140062fe6
movdqu xmm0, xmmword [rcx + 4]
shr rbx, 4
mov qword [rsp + 0x20], rbx
mov r12, rbx
movdqu xmmword [rsp + 0x28], xmm0
test rbx, rbx
je 0x140062fd8
mov r13d, dword [r11 - 0x54]
mov r14d, dword [r11 - 0x58]
mov r15d, dword [r11 - 0x5c]
mov ebx, dword [rsp + 0x28]
lea r8, [rsp + 0x38]
mov rdx, rsi
mov rcx, rdi
call fcn.1400625b4
mov r11d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x44]
xor r11d, ebx
mov ebx, dword [rsi]
xor edx, r15d
mov r15d, dword [rsi + 4]
xor ecx, r14d
mov r14d, dword [rsi + 8]
xor eax, r13d
mov r13d, dword [rsi + 0xc]
mov dword [rbp], r11d
mov dword [rbp + 4], edx
mov dword [rbp + 8], ecx
mov dword [rbp + 0xc], eax
add rbp, 0x10
add rsi, 0x10
sub r12, 1
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x3c], edx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x44], eax
jne 0x140062f53
mov dword [rsp + 0x28], ebx
mov rbx, qword [rsp + 0x20]
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x2c], r15d
movdqu xmm0, xmmword [rsp + 0x28]
shl rbx, 4
movdqu xmmword [rdi + 4], xmm0
mov rax, rbx
jmp 0x140062fe8
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a8530
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140065414
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rcx, rdx
lea rdx, [0x1400c378c]
call fcn.140086b4c
xor esi, esi
mov rdi, rax
cmp rax, rsi
je 0x140065621
lea r14d, [rsi + 1]
lea edx, [rsi + 0x16]
lea rcx, [rsp + 0x38]
mov r8, r14
mov r9, rax
call fcn.1400a9fd4
cmp word [rsp + 0x38], si
jne 0x140065619
cmp word [rsp + 0x3a], r14w
jne 0x140065619
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400aa2d4
movzx r11d, word [rsp + 0x3c]
sub r11d, r14d
movsxd rcx, r11d
shl rcx, 4
add rcx, 0x16
call fcn.1400a85ec
movzx ecx, word [rsp + 0x3c]
sub ecx, r14d
mov r15, rax
movsxd rcx, ecx
imul rcx, rcx, 0xe
add rcx, 0x14
call fcn.1400a85ec
movzx ecx, word [rsp + 0x3c]
mov r9, rdi
sub ecx, r14d
mov r8, r14
mov r13, rax
movsxd rdx, ecx
mov rcx, r15
shl rdx, 4
add rdx, 0x16
call fcn.1400a9fd4
mov rcx, qword [r15]
mov ebp, esi
mov qword [r13], rcx
mov rax, qword [r15 + 8]
mov qword [r13 + 8], rax
mov eax, dword [r15 + 0x10]
mov dword [r13 + 0x10], eax
cmp si, word [rsp + 0x3c]
jae 0x1400655cd
movsxd rcx, ebp
lea r12d, [r14 + rbp]
mov rbx, rcx
add rbx, rbx
imul rcx, rcx, 0xe
mov rax, qword [r15 + rbx*8 + 6]
mov qword [rcx + r13 + 6], rax
mov eax, dword [r15 + rbx*8 + 0xe]
mov word [rcx + r13 + 0x12], r12w
mov dword [rcx + r13 + 0xe], eax
mov eax, dword [r15 + rbx*8 + 0xe]
mov rcx, rax
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x30], rax
call fcn.1400a85ec
mov rcx, rdi
mov r14, rax
cmp rax, rsi
je 0x14006561c
mov edx, dword [r15 + rbx*8 + 0x12]
xor r8d, r8d
call fcn.1400aa2d4
mov rdx, qword [rsp + 0x30]
mov r9, rdi
mov r8d, 1
mov rcx, r14
call fcn.1400a9fd4
mov eax, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x28], eax
mov r9d, 0x400
movzx r8d, r12w
mov edx, 3
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
mov rcx, r14
mov ebx, eax
call fcn.1400a86a4
cmp ebx, esi
je 0x140065619
movzx eax, word [rsp + 0x3c]
mov r14d, 1
add ebp, r14d
cmp ebp, eax
jl 0x140065506
mov rcx, rdi
call fcn.1400aa410
movzx r11d, word [rsp + 0x3c]
movzx r8d, word [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
sub r11d, r14d
mov r9d, 0x400
mov edx, 0xe
imul r11d, r11d, 0xe
add r11d, 0x14
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
cmp eax, esi
setne al
jmp 0x140065623
mov rcx, rdi
call fcn.1400aa410
xor al, al
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006563c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rax, rdx
mov r12, rcx
lea rdx, [0x1400c378c]
mov rcx, rax
mov ebp, r8d
call fcn.140086b4c
xor esi, esi
mov rbx, rax
cmp rax, rsi
je 0x140065708
mov rcx, rax
call fcn.1400ac32c
cmp eax, 0x42
jne 0x140065700
mov rcx, rbx
call fcn.1400ac32c
cmp eax, 0x4d
jne 0x140065700
lea edx, [rsi + 2]
xor r8d, r8d
mov rcx, rbx
call fcn.1400aa2d4
lea edx, [rsi + 4]
lea r8d, [rsi + 1]
lea rcx, [rsp + 0x68]
mov r9, rbx
call fcn.1400a9fd4
mov r11d, dword [rsp + 0x68]
add r11d, 0xfffffff2
mov ecx, r11d
mov dword [rsp + 0x68], r11d
call fcn.1400a85ec
mov rcx, rbx
mov rdi, rax
cmp rax, rsi
je 0x140065703
lea edx, [rsi + 0xe]
xor r8d, r8d
call fcn.1400aa2d4
mov r8d, dword [rsp + 0x68]
lea edx, [rsi + 1]
mov r9, rbx
mov rcx, rdi
call fcn.1400a9fd4
mov ecx, dword [rsp + 0x68]
cmp rax, rcx
je 0x14006571d
mov rcx, rdi
call fcn.1400a86a4
mov rcx, rbx
call fcn.1400aa410
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.1400aa410
mov ecx, dword [rsp + 0x68]
mov r9d, 0x400
mov dword [rsp + 0x28], ecx
movzx r8d, bp
mov edx, 2
mov rcx, r12
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
mov rcx, rdi
mov ebx, eax
call fcn.1400a86a4
cmp ebx, esi
setne al
jmp 0x14006570a

Function at 0x1400657a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x420], rax
lea rdx, [0x1400c378c]
call fcn.140086b4c
xor edi, edi
mov rsi, rax
cmp rax, rdi
jne 0x1400657de
mov al, 1
jmp 0x14006582f
lea rcx, [rsp + 0x20]
mov r9, rax
mov edx, 1
mov r8d, 0x400
call fcn.1400a9fd4
mov rcx, rsi
mov rbx, rax
call fcn.1400aa410
lea ecx, [rbx - 4]
cmp ecx, edi
jle 0x14006582d
lea rax, [rsp + 0x21]
cmp byte [rax - 1], 0x55
jne 0x140065824
cmp byte [rax], 0x50
jne 0x140065824
cmp byte [rax + 1], 0x58
jne 0x140065824
cmp byte [rax + 2], 0x30
je 0x1400657da
inc edi
inc rax
cmp edi, ecx
jl 0x14006580d
xor al, al
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140065854
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2030
call fcn.1400ba8b0
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rdi, rdx
lea rdx, [0x1400c378c]
call fcn.140086b4c
mov rbx, rax
test rax, rax
je 0x1400658d8
mov r9, rax
mov esi, 1
jmp 0x1400658b5
lea rcx, [rsp + 0x20]
mov r9, rdi
mov r8, rax
mov rdx, rsi
call fcn.1400aa698
mov r9, rbx
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
mov rdx, rsi
call fcn.1400a9fd4
test rax, rax
jne 0x14006589f
mov rcx, rbx
call fcn.1400aa410
mov al, sil
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140065900
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2030
call fcn.1400ba8b0
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r13, rdx
lea rdx, [0x1400c378c]
mov r14, r8
call fcn.140086b4c
mov rdi, rax
test rax, rax
je 0x140065a04
xor r12d, r12d
mov r9, rax
lea r15d, [r12 + 1]
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
mov rdx, r15
call fcn.1400a9fd4
mov rbp, rax
cmp rax, 0x20
jbe 0x1400659fc
lea rsi, [rax - 0x20]
xor ebx, ebx
test rsi, rsi
je 0x1400659b4
cmp byte [rsp + rbx + 0x20], 0x2a
jne 0x1400659ac
cmp byte [rsp + rbx + 0x21], 0x2a
jne 0x1400659ac
lea rcx, [rsp + rbx + 0x22]
lea rdx, str.messages
mov r8d, 0xc
call fcn.1400aa8cc
test eax, eax
je 0x1400659cc
add rbx, r15
cmp rbx, rsi
jb 0x140065983
lea r12d, [r12 + rbp - 0x20]
xor r8d, r8d
mov rcx, rdi
mov edx, r12d
call fcn.1400aa2d4
mov r9, rdi
jmp 0x140065958
lea edx, [rbx + r12]
xor r8d, r8d
mov rcx, rdi
call fcn.1400aa2d4
mov r9, rdi
mov r8, r14
mov rdx, r15
mov rcx, r13
call fcn.1400a9fd4
mov rcx, rdi
mov rbx, rax
call fcn.1400aa410
mov rax, rbx
jmp 0x140065a06
mov rcx, rdi
call fcn.1400aa410
xor eax, eax
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400a8530
mov rbx, qword [rsp + 0x2088]
add rsp, 0x2030
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140065a34
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x2030
call fcn.1400ba8b0
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x2020], rax
lea rdx, [0x1400c8b90]
call fcn.140086b4c
mov rdi, rax
test rax, rax
je 0x140065b44
xor r13d, r13d
mov r9, rax
lea r14d, [r13 + 1]
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
mov rdx, r14
call fcn.1400a9fd4
mov r12, rax
cmp rax, 0x20
jbe 0x140065b3c
lea ebp, [r12 - 0x20]
xor esi, esi
test ebp, ebp
jle 0x140065aea
lea rbx, [rsp + 0x21]
cmp byte [rbx - 1], 0x61
jne 0x140065ae0
cmp byte [rbx], 0x73
jne 0x140065ae0
movsxd rax, esi
lea rdx, str.Invoker_
mov r8d, 0x14
lea rcx, [rsp + rax + 0x22]
call fcn.1400aa8cc
test eax, eax
je 0x140065b02
add esi, r14d
add rbx, r14
cmp esi, ebp
jl 0x140065ab7
lea r13d, [r13 + r12 - 0x20]
xor r8d, r8d
mov rcx, rdi
mov edx, r13d
call fcn.1400aa2d4
mov r9, rdi
jmp 0x140065a87
lea edx, [rsi + r13]
xor r8d, r8d
mov rcx, rdi
call fcn.1400aa2d4
lea rcx, str.requireAdministrator_
mov r9, rdi
mov r8d, 0x15
mov rdx, r14
call fcn.1400aa698
mov rcx, rdi
cmp rax, 0x15
sete bl
call fcn.1400aa410
mov al, bl
jmp 0x140065b46
mov rcx, rdi
call fcn.1400aa410
xor al, al
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140065f04
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x28
mov r8, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x1400c64b8]
call fcn.14005c3a0
mov r11, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x800]
lea rdx, str.PathType
call fcn.14005c3b8
mov r11, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x804]
lea rdx, str.SavePath
call fcn.14005c3b8
mov r8, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
lea rdx, str.Setup
add r8, 0x806
call fcn.14005c3a0
mov r8, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
lea rdx, str.Presetup
add r8, 0x1006
call fcn.14005c3a0
mov r11, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x1806]
lea rdx, str.TempMode
call fcn.14005c3b8
mov r8, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
lea rdx, str.TempModeQuestion
add r8, 0x1808
call fcn.14005c3a0
mov r8, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
lea rdx, str.TempModeTitle
add r8, 0x2008
call fcn.14005c3a0
mov r11, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x2208]
lea rdx, str.Silent
call fcn.14005c3b8
mov r11, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x220c]
lea rdx, str.Overwrite
call fcn.14005c3b8
mov r11, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x2211]
lea rdx, str.UpdateFiles
call fcn.14005c3b8
mov r11, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x2210]
lea rdx, str.FreshFiles
call fcn.14005c3b8
mov r8, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
lea rdx, str.DelFiles
add r8, 0x2212
call fcn.14005c3a0
mov r8, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
lea rdx, str.Title
add r8, 0x4212
call fcn.14005c3a0
mov r8, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x1400c8c28]
add r8, 0x4412
call fcn.14005c3a0
mov r8, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
lea rdx, str.LicenseTitle
add r8, 0x24412
call fcn.14005c3a0
mov r8, qword [0x14011de78]
add r8, 0x24612
mov rcx, qword [str.SFXDefault]
lea rdx, str.LicenseText
call fcn.14005c3a0
mov r8, qword [0x14011de78]
mov rcx, qword [str.SFXDefault]
lea rdx, str.ShortcutText
add r8, 0x44612
call fcn.14005c3a0
mov rcx, qword [str.SFXDefault]
lea r8, [0x14010ce5a]
lea rdx, str.SFXLogo
call fcn.14005c3a0
mov rcx, qword [str.SFXDefault]
lea r8, [0x14010c65a]
lea rdx, str.SFXIcon
call fcn.14005c3a0
movzx r8d, byte [0x14010d65a]
mov rcx, qword [str.SFXDefault]
lea rdx, str.SFXElevate
call fcn.14005c3b8
mov rcx, qword [str.SFXDefault]
lea r8, [0x140108b40]
lea rdx, str.SFXModule
add rsp, 0x28
jmp fcn.14005c3a0
Function at 0x140066a24
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2030
call fcn.1400ba8b0
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x2020], rax
lea rdx, [0x1400c378c]
xor r8d, r8d
call fcn.1400319b0
mov rsi, rax
test rax, rax
je 0x140066b0d
xor r12d, r12d
xor r13d, r13d
lea ebx, [r12 + 1]
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8d, 0x2000
mov rdx, rbx
call fcn.1400a9fd4
cmp eax, 0x20
mov r15, rax
jle 0x140066b01
lea r14d, [rax - 0x20]
xor ebp, ebp
test r14d, r14d
jle 0x140066ae2
lea rdi, [rsp + 0x21]
cmp byte [rdi - 1], 0x72
jne 0x140066ad8
cmp byte [rdi], 0x65
jne 0x140066ad8
movsxd rax, ebp
lea rdx, str.quireAdministrator_
mov r8d, 0x14
lea rcx, [rsp + rax + 0x22]
call fcn.1400aa8cc
test eax, eax
je 0x140066b03
add ebp, ebx
add rdi, rbx
cmp ebp, r14d
jl 0x140066aaf
lea r12d, [r12 + r15 - 0x20]
xor r8d, r8d
mov rcx, rsi
mov edx, r12d
call fcn.1400aa2d4
add r13d, ebx
cmp r13d, 0x80
jb 0x140066a81
xor bl, bl
mov rcx, rsi
call fcn.1400aa410
mov al, bl
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret