joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007cf0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xa0
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov rax, qword [0x14003a088]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov qword [r11 - 0x20], 7
xor ebx, ebx
mov qword [r11 - 0x28], rbx
mov word [rsp + 0x70], bx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x54], ebx
lea rdx, str.rdev
call fcn.140002c30
cmp word [rax], bx
jne 0x140007d46
mov r8d, ebx
jmp 0x140007d5b
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140007d50
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140004500
lea rcx, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
call fcn.140007a00
mov dword [rsp + 0x58], eax
test eax, eax
jne 0x140007da7
lea rcx, str.Device_removed_succesfully
call fcn.1400078f0
mov eax, ebx
cmp dword [rsp + 0x50], ebx
setne al
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf023f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareIntelDifx64
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Code
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Reboot
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov r8, qword [rsp + 0x88]
cmp r8, 8
jb 0x140007e67
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.140004d90
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140009810
add rsp, 0xa0
pop rbx
ret
Function at 0x140009cc8
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140009d59
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140009d59
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009d59
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140009d3d
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140009d37
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140009d3f
add rdx, 0x28
jmp 0x140009d1c
xor edx, edx
test rdx, rdx
jne 0x140009d48
xor al, al
jmp 0x140009d5f
test dword [rdx + 0x24], 0x80000000
je 0x140009d55
xor al, al
jmp 0x140009d5f
mov al, 1
jmp 0x140009d5f
xor al, al
jmp 0x140009d5f
add rsp, 0x18
ret

Function at 0x1400147d8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400145ac
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400145ac
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400145ac
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400145ac
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400145ac
cmp dword [rcx + 0x84], 0xe
jbe 0x1400145ac
cmp dword [rcx + 0xf8], esi
je 0x1400145ac
mov ecx, r14d
call fcn.1400146f4
mov ecx, 2
call fcn.14001074c
nop
cmp byte [0x14003c0d0], 0
jne 0x140014676
mov r15d, 1
mov eax, r15d
xchg dword [0x14003c0c0], eax
test ebx, ebx
jne 0x14001461f
mov rdi, qword [0x14003a088]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14003c0c8]
cmp rcx, rax
je 0x140014616
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140001310]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14003c310]
jmp 0x14001462b
cmp ebx, r15d
jne 0x140014631
lea rcx, [0x14003c328]
call fcn.140015144
nop
test ebx, ebx
jne 0x140014648
lea rdx, [0x1400243f0]
lea rcx, [0x1400243d0]
call fcn.140015460
lea rdx, [0x140024400]
lea rcx, [0x1400243f8]
call fcn.140015460
movzx eax, byte [0x14003c0d0]
test esi, esi
cmove eax, r15d
mov byte [0x14003c0d0], al
jmp 0x140014676
mov ecx, 2
call fcn.1400107a0
test esi, esi
jne 0x14001468d
mov ecx, r14d
call fcn.1400146a8
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14001453c
Function at 0x140011483
Capabilities:
Terminate process

Disassembly:
jmp 0x14001c7f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400115d2
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001db40
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001db60
xor al, al
jmp 0x14001dbe1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001db73
xor al, al
jmp 0x14001dbe1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001db9d
xor al, al
jmp 0x14001dbe1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001dbb1
xor al, al
jmp 0x14001dbe1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001dbc3
xor al, al
jmp 0x14001dbe1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001dbdf
xor al, al
jmp 0x14001dbe1
mov al, 1
add rsp, 0x38
ret
Function at 0x180001000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
mov rsi, qword [0x1800042a0]
mov ecx, 0x8664
xor ebx, ebx
movsxd rax, dword [rsi + 0x3c]
cmp word [rax + rsi + 4], cx
jne 0x180001034
mov edi, dword [rax + rsi + 0x88]
jmp 0x180001038
mov edi, dword [rax + rsi + 0x78]
add rdi, rsi
mov qword [rsp + 0x18], r15
mov ebp, dword [rdi + 0x20]
mov r14d, dword [rdi + 0x24]
mov r11d, dword [rdi + 0x18]
add rbp, rsi
add r14, rsi
dec r11d
js 0x1800010c8
lea r15, str.CreateProcessW
nop dword [rax]
lea r10d, [r11 + rbx]
sar r10d, 1
movsxd rax, r10d
mov ecx, dword [rbp + rax*4]
lea r8, [rcx + rsi]
cmp r15, r8
je 0x1800010e2
test r8, r8
je 0x1800010bf
mov r9, r15
sub r9, r8
movzx eax, byte [r9 + r8]
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x180001091
add al, 0x20
movzx edx, byte [r8]
lea ecx, [rdx - 0x41]
cmp cl, 0x19
ja 0x1800010a0
add dl, 0x20
inc r8
test al, al
je 0x1800010ab
cmp al, dl
je 0x180001082
movsx ecx, dl
movsx edx, al
sub edx, ecx
jns 0x1800010bb
lea r11d, [r10 - 1]
jmp 0x1800010c3
test edx, edx
jle 0x1800010e2
lea ebx, [r10 + 1]
cmp r11d, ebx
jge 0x180001060
xor eax, eax
mov r15, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r14
pop rdi
ret
cmp r11d, ebx
jl 0x1800010c8
movsxd rax, r10d
movzx ecx, word [r14 + rax*2]
cmp ecx, dword [rdi + 0x14]
jae 0x1800010c8
movzx edx, cx
mov ecx, dword [rdi + 0x1c]
add rcx, rsi
mov eax, dword [rcx + rdx*4]
add rax, rsi
jmp 0x1800010ca

Function at 0x180001110
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
mov rax, qword gs:[0x30]
mov r8, rcx
mov rdx, qword [rax + 0x60]
mov r9, qword [rdx + 0x20]
mov dword [rcx], 0x68
mov rax, qword [r9 + 0xd8]
mov qword [rcx + 8], rax
mov rax, qword [r9 + 0xc8]
mov qword [rcx + 0x10], rax
mov rax, qword [r9 + 0xb8]
mov qword [rcx + 0x18], rax
mov eax, dword [r9 + 0x88]
mov dword [rcx + 0x20], eax
mov eax, dword [r9 + 0x8c]
mov dword [rcx + 0x24], eax
mov eax, dword [r9 + 0x90]
mov dword [rcx + 0x28], eax
mov eax, dword [r9 + 0x94]
mov dword [rcx + 0x2c], eax
mov eax, dword [r9 + 0x98]
mov dword [rcx + 0x30], eax
mov eax, dword [r9 + 0x9c]
mov dword [rcx + 0x34], eax
mov eax, dword [r9 + 0xa0]
mov dword [rcx + 0x38], eax
mov ecx, dword [r9 + 0xa4]
mov dword [r8 + 0x3c], ecx
movzx eax, word [r9 + 0xa8]
mov word [r8 + 0x40], ax
movzx eax, word [r9 + 0xe0]
mov word [r8 + 0x42], ax
mov rax, qword [r9 + 0xe8]
mov qword [r8 + 0x48], rax
test ecx, 0x300
je 0x1800011e1
mov rax, qword [r9 + 0x20]
mov qword [r8 + 0x50], rax
mov rax, qword [r9 + 0x28]
mov qword [r8 + 0x58], rax
mov rax, qword [r9 + 0x30]
mov qword [r8 + 0x60], rax
ret
Function at 0x1800011f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x620]
sub rsp, 0x720
xor eax, eax
lea rdi, [rbp - 0x70]
mov ecx, 0x68
rep stosb byte [rdi], al
lea rdi, [rsp + 0x70]
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x68
call fcn.180001110
xor eax, eax
lea rdi, [rbp]
mov ecx, 0x20a
lea rdx, str._systemroot__system32_
rep stosb byte [rdi], al
lea rdi, [rsp + 0x60]
mov ecx, 0x10
rep stosb byte [rdi], al
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp]
lea r9, [rbp + 0x630]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
xor ebx, ebx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 0x2080000
mov dword [rbp + 0x630], ebx
call qword [sym.imp.ntdll.dll_RtlExpandEnvironmentStrings_U]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x1800012b8
cmp eax, 0xc0000023
je 0x1800012b8
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x1800013ae
mov eax, dword [rbp + 0x630]
shr eax, 1
dec eax
cmp eax, 0x102
ja 0x1800013ae
xor eax, eax
lea rdi, [rbp + 0x210]
mov ecx, 0x410
rep stosb byte [rdi], al
movzx ecx, word [rbp]
lea rdx, [rbp + 0x210]
test cx, cx
je 0x180001314
lea rdi, [rbp]
lea rax, [rbp + 0x210]
sub rdi, rax
nop dword [rax + rax]
movzx eax, word [rdi + rdx + 2]
mov word [rdx], cx
add rdx, 2
movzx ecx, ax
test ax, ax
jne 0x180001300
mov word [rdx], bx
lea rax, [rbp + 0x210]
cmp word [rbp + 0x210], bx
je 0x180001330
add rax, 2
cmp word [rax], bx
jne 0x180001327
lea rdi, str.cmd.exe
mov edx, 0x63
sub rdi, rax
nop
movzx ecx, word [rdi + rax + 2]
lea rax, [rax + 2]
movzx edx, cx
test cx, cx
jne 0x180001340
lea rax, [rsp + 0x70]
lea rdx, str.boom1_cccIpn5wgPxcCn8XLPRJLo6EKbn8umAQ3LAMaUOkvcegOhCLhakbBOXsQw2pCoEZSAINinxKyUJk36QphCi8mmjeqZH7L1iWEI3FsLJmNA_2FbLrvxTCeGXOVdiJ9eNv4J6_2B3fD4S5mGVF5Hg12CZtE2j0PYOlhUINeaQgCeX3qrTtzjienRsxvbAmR93R_2FO8J3sp3XpeyP7hsM7xzXrC92DpGADM_2Fqo_2BaKPVc9_2B0dkA8L8tsQ3A_2F8w8le
lea rcx, str.C:UsersJohnAppDataLocalTemp9BE1.exe
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rbp]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [0x180004210]
test eax, eax
je 0x1800013ae
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtClose]
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1800014e0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
cmp edx, 4
jne 0x18000157b
lea rcx, str.UACMe_injected__Hibiki_at_your_service.
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ntdll.dll_DbgPrint]
xor eax, eax
lea rdx, [0x180004230]
xorps xmm0, xmm0
mov qword [0x180004228], rax
mov qword [0x180004280], rax
mov dword [0x180004288], eax
movdqu xmmword [0x180004218], xmm0
mov qword [0x180004290], rax
lea rax, [0x180004218]
mov rdi, rdx
mov qword [0x180004298], rax
xor eax, eax
mov ecx, 0x50
rep stosb byte [rdi], al
mov rdi, qword [rsp + 0x30]
lea rax, [0x180004280]
mov qword [0x180004238], rax
lea rax, [0x1800013d0]
mov dword [0x180004230], 0x50
mov qword [0x180004240], rax
mov qword [rbx], rdx
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x18000cb50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1b0
mov rax, qword [0x18008b590]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
jne 0x18000cb84
mov eax, 0x80070057
jmp 0x18000cd06
mov qword [rsp + 0x1d0], rbx
xor ebx, ebx
xor r9d, r9d
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18000ccd5
xor eax, eax
lea r9, [rsp + 0x30]
lea r8d, [rbx + 0x40]
lea rdx, [rsp + 0x140]
mov rcx, rdi
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000ccd5
cmp dword [rsp + 0x30], 0x40
jne 0x18000cce3
movsxd rdx, dword [rsp + 0x17c]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18000ccd5
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0xf8
call fcn.18005ce70
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0xf8
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000ccd5
cmp dword [rsp + 0x30], 0xf8
jne 0x18000cce3
movzx eax, word [rsp + 0x46]
lea r9d, [rbx + 1]
xor r8d, r8d
dec eax
mov rcx, rdi
cdqe
lea rdx, [rax + rax*4]
shl rdx, 3
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18000ccd5
lea r8d, [rbx + 0x28]
lea rcx, [rsp + 0x180]
xor edx, edx
call fcn.18005ce70
lea r9, [rsp + 0x30]
lea r8d, [rbx + 0x28]
lea rdx, [rsp + 0x180]
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18000ccdc
call fcn.180007940
jmp 0x18000ccfe
cmp dword [rsp + 0x30], 0x28
je 0x18000ccea
mov eax, 0x80004005
jmp 0x18000ccfe
mov eax, dword [rsp + 0x190]
mov ecx, dword [rsp + 0x194]
add ecx, eax
xor eax, eax
mov dword [rsi], ecx
mov rbx, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.180058250
mov rsi, qword [rsp + 0x1d8]
add rsp, 0x1b0
pop rdi
ret
Function at 0x180010450
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x6a0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x18008b590]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
xor r13d, r13d
mov dword [rsp + 0x34], r13d
mov r9, qword [rdx + 0x18]
test r9, r9
jne 0x1800104bb
mov r8d, 0x10e
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x18001050b
cmp qword [rdx + 0x20], 8
jb 0x1800104c8
mov rdi, qword [rdx + 8]
jmp 0x1800104cc
lea rdi, [rdx + 8]
mov edx, r13d
test r9, r9
je 0x180010505
lea rcx, [rsp + 0x70]
lea rax, [rsp + 0x70]
sub rdi, rax
nop word [rax + rax]
movzx eax, word [rdi + rcx]
mov word [rcx], ax
inc edx
add rcx, 2
movsxd rax, edx
cmp rax, r9
jb 0x1800104f0
mov word [rsp + r9*2 + 0x70], r13w
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
mov eax, 2
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.180058214
mov rbp, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x70]
sub rax, rcx
nop word [rax + rax]
movzx ecx, word [rdx]
mov word [rax + rdx], cx
add rdx, 2
test cx, cx
jne 0x180010550
mov dword [rsp + 0x30], r13d
lea rdx, [rsp + 0x30]
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
mov ecx, eax
call fcn.180058214
mov r12, rax
mov r9, rax
mov r8d, edi
xor edx, edx
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x50]
lea rdx, str.VarFileInfoTranslation
mov rcx, r12
call sub.VERSION.dll_VerQueryValueW
mov qword [rsi + 0x20], 7
mov qword [rsi + 0x18], r13
mov word [rsi + 8], r13w
mov dword [rsp + 0x34], 1
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x40]
lea rdx, [0x18007c86c]
mov rcx, r12
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x180010655
mov word [rsp + 0x290], r13w
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rsp + 0x292]
call fcn.18005ce70
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx + 0xc]
movzx edx, word [rcx + 0xe]
movzx r9d, word [rcx + 8]
movzx r8d, word [rcx + 0xa]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, [0x18007c870]
lea rcx, [rsp + 0x290]
call fcn.180058dac
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0x290]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x290]
mov rcx, rsi
call fcn.180006be0
mov rcx, rbp
call fcn.180058a20
mov rcx, r12
call fcn.180058a20
nop
cmp qword [rbx + 0x20], 8
jb 0x180010676
mov rcx, qword [rbx + 8]
call fcn.18005822c
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], r13
mov word [rbx + 8], r13w
mov rax, rsi
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.180058250
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180014210
Capabilities:
Delete file

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov r12, r9
mov r13, r8
mov rbp, rdx
mov rsi, rcx
mov ecx, 0xf8
call fcn.180058920
mov qword [rsp + 0x68], rax
test rax, rax
je 0x18001425f
mov rcx, rax
call fcn.18000d470
mov rbx, rax
jmp 0x180014261
xor ebx, ebx
mov qword [rsp + 0x68], rbx
test rbx, rbx
je 0x180014275
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov r8, qword [rbp + 0x58]
mov rdx, rbp
mov rcx, rbx
call fcn.180018440
mov edi, eax
test eax, eax
je 0x18001429f
test rbx, rbx
je 0x180014298
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
mov eax, edi
jmp 0x180014374
mov r8, qword [rsi + 0xb0]
mov rdx, qword [rsi + 0xb8]
mov rcx, rbx
call fcn.18000d530
mov r8, r12
mov rdx, rbp
mov rcx, rbx
call fcn.180018620
mov edi, eax
test eax, eax
je 0x1800142de
test rbx, rbx
je 0x1800142d7
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
mov eax, edi
jmp 0x180014374
mov qword [rsp + 0x20], r12
mov r9, r13
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.180014160
mov edi, eax
test eax, eax
js 0x180014324
cmp eax, 1
je 0x180014324
mov rcx, rbx
call fcn.180019570
mov edi, eax
mov rcx, rsi
call fcn.1800120d0
nop
test rbx, rbx
je 0x180014320
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
mov eax, edi
jmp 0x180014374
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x18001433b
mov qword [rbx + 0x58], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [rbx + 0xb0], 8
jb 0x18001434e
mov rcx, qword [rbx + 0x98]
jmp 0x180014355
lea rcx, [rbx + 0x98]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rsi
call fcn.1800120d0
nop
test rbx, rbx
je 0x180014372
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x180016fa0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbp, rdx
test rdx, rdx
jne 0x180016fca
mov eax, 0x80070057
jmp 0x180017154
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r13 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0xa8], rax
cmp rax, 0xffffffffffffffff
jne 0x18001700d
call fcn.180007940
nop
jmp 0x180017154
mov qword [rsp + 0xa0], r13
lea rdx, [rsp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x180017041
call fcn.180007940
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180017154
lea rdx, [0x18008df40]
mov r14d, 0x100000
mov rcx, r14
call fcn.180058a28
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x180017076
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8007000e
jmp 0x180017154
mov rsi, r13
cmp qword [rsp + 0xa0], r13
jbe 0x180017140
nop word [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.18005ce70
mov r11, qword [rsp + 0xa0]
sub r11, rsi
cmp r11, r14
cmova r11d, r14d
mov dword [rsp + 0x98], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x98]
mov r8d, r11d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180017123
mov rax, qword [rbp]
xor r9d, r9d
mov r8d, dword [rsp + 0x98]
mov rdx, rdi
mov rcx, rbp
call qword [rax + 0x18]
mov r12d, eax
test eax, eax
jne 0x18001710c
mov eax, dword [rsp + 0x98]
add rsi, rax
cmp rsi, qword [rsp + 0xa0]
jb 0x180017090
jmp 0x180017140
mov rcx, rdi
call fcn.180058a20
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
jmp 0x180017154
call fcn.180007940
mov esi, eax
mov rcx, rdi
call fcn.180058a20
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x180017154
mov rcx, rdi
call fcn.180058a20
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180017430
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, r9
test r9, r9
je 0x180017443
mov dword [r9], eax
test r8d, r8d
je 0x18001747c
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18001746f
call fcn.180007940
add rsp, 0x30
pop rbx
ret
test rbx, rbx
je 0x18001747a
mov eax, dword [rsp + 0x50]
mov dword [rbx], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x180017490
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rbx, rcx
call qword [rax + 0x20]
test eax, eax
jne 0x1800174c3
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800174c1
add rsp, 0x20
pop rbx
jmp fcn.180007940
xor eax, eax
add rsp, 0x20
pop rbx
ret