joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000200c
Capabilities:
Link many functions at runtime
Read file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x1400342a0]
xor rax, rbp
mov qword [rbp + 0x50], rax
mov rbx, rdx
lea rdx, str.Py_Initialize
mov qword [rbp + 0x18], r9
mov dword [rbp], r8d
mov r14, rcx
mov qword [rbp + 8], rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PySys_SetArgv
mov rcx, r14
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyRun_SimpleString
mov rcx, r14
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_Finalize
mov rcx, r14
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_BuildValue
mov rcx, r14
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyCFunction_New
mov rcx, r14
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyArg_ParseTuple
mov rcx, r14
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 8]
lea rdx, str.PyErr_Format
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [rbp + 0x10], 0
je 0x14000221f
test rdi, rdi
je 0x14000221f
test r13, r13
je 0x14000221f
test r12, r12
je 0x14000221f
test rsi, rsi
je 0x14000221f
test r14, r14
je 0x14000221f
test rax, rax
je 0x14000221f
test r15, r15
je 0x14000221f
test rbx, rbx
je 0x140002218
cmp byte [rbx], 0
je 0x140002218
xor edx, edx
mov rcx, rbx
call fcn.140022450
mov esi, eax
cmp eax, 0xffffffff
jne 0x140002178
call fcn.14000a3b0
lea rdx, str.Could_not_open_postinstall_script__s_n
mov r8, rbx
lea rcx, [rax + 0x60]
call fcn.14000a190
lea eax, [rsi + 4]
jmp 0x140002224
mov rcx, qword [0x140037c00]
lea r8, str.Running_Script...
mov edx, 0x3ec
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
call qword [rbp + 0x10]
mov rcx, qword [rbp + 8]
call fcn.140001e6c
mov rdx, qword [rbp + 0x18]
mov ecx, dword [rbp]
call rdi
lea rdx, [rbp + 0x20]
mov ecx, esi
mov ebx, 3
call fcn.140009d50
test eax, eax
jne 0x14000220a
mov r8d, dword [rbp + 0x34]
lea eax, [r8 + 5]
movsxd rcx, eax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400021d8
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140025f10
sub rsp, rax
mov ecx, esi
lea rdi, [rsp + 0x20]
mov rdx, rdi
call fcn.1400231d4
test eax, eax
jle 0x14000220a
cdqe
mov rcx, rdi
mov byte [rax + rdi], 0xa
mov byte [rax + rdi + 1], 0
call r13
mov ebx, eax
call r12
mov ecx, esi
call fcn.140017ba4
mov eax, ebx
jmp 0x140002224
mov eax, 2
jmp 0x140002224
mov eax, 1
mov rcx, qword [rbp + 0x50]
xor rcx, rbp
call fcn.140009080
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x60]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140002254
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
and qword [r9], 0
mov r14d, edx
mov r15, rcx
xor edx, edx
xor ecx, ecx
mov rsi, r9
mov r13, r8
mov ebp, 1
call fcn.1400259e4
and qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, ebp
mov rcx, rax
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80000080
mov r12, rax
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, 0xfffffff5
mov rbx, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff4
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdx, rbx
mov ecx, edi
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rdx, rbx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
lea rcx, [0x140036a20]
call fcn.140001d30
mov rdi, rax
test rax, rax
je 0x14000232e
mov r9, r13
mov r8d, r14d
mov rdx, r15
mov rcx, rax
call fcn.14000200c
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140002343
call fcn.14000a3b0
lea rdx, str._Could_not_load_Python_
lea rcx, [rax + 0x60]
call fcn.14000a190
mov rdx, qword [rsp + 0x98]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rdx, qword [rsp + 0x40]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, 0x1000
cmp eax, edi
jae 0x140002387
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [rdi + 1]
movsxd rcx, eax
call fcn.14000993c
xor r13d, r13d
mov qword [rsi], rax
cmp rax, r13
je 0x1400023e1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x98], r13d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rdx, qword [rsi]
lea r9, [rsp + 0x98]
mov r8d, edi
mov rcx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x98]
mov rax, qword [rsi]
mov byte [r11 + rax], r13b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea r11, [rsp + 0x50]
mov eax, ebp
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002414
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r14, rdx
lea rdx, str.Py_Initialize
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_SetProgramName
mov rcx, r12
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_Finalize
mov rcx, r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyRun_SimpleString
mov rcx, r12
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyErr_Print
mov rcx, r12
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test r13, r13
je 0x1400024d3
test rbx, rbx
je 0x1400024d3
test rdi, rdi
je 0x1400024d3
test rbp, rbp
je 0x1400024d3
test rax, rax
je 0x1400024d3
lea rcx, [0x140036900]
call rbx
call r13
mov rcx, r12
call fcn.140001e6c
mov rcx, r14
call rbp
mov ebx, eax
test eax, eax
je 0x1400024cd
call rsi
call rdi
mov eax, ebx
jmp 0x1400024d6
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x1400024f8
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xe0
mov rax, qword [0x1400342a0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rcx
xor edx, edx
xor ecx, ecx
call fcn.1400259e4
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0xc0000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80000080
mov r14, rax
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, 0xfffffff5
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12d, 0xfffffff4
mov ecx, r12d
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdx, rsi
mov ecx, edi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rdx, rsi
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
lea rcx, [0x140036a20]
call fcn.140001d30
mov rdi, rax
test rax, rax
jne 0x1400025da
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Cant_load_Python_for_pre_install_script___d_
lea rcx, [rsp + 0x50]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x50]
call fcn.140001834
or eax, 0xffffffff
jmp 0x1400026df
mov rdx, rbx
mov rcx, rax
call fcn.140002414
mov rcx, rdi
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdx, rbp
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov rdx, r13
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
test r12d, r12d
je 0x1400026ca
or rcx, 0xffffffffffffffff
xor eax, eax
lea rbx, str.Running_the_pre_installation_script_failed_r_n
mov rdi, rbx
xor edx, edx
repne scasb al, byte [rdi]
not rcx
lea r13, [rcx - 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
mov eax, 0x1000
cmp ebp, 0xffffffff
cmove ebp, eax
lea eax, [rbp + r13 + 1]
movsxd rcx, eax
call fcn.14000993c
mov rdi, rax
test rax, rax
je 0x1400026be
and dword [rsp + 0x40], 0
mov rdx, rax
sub rdx, rbx
mov cl, byte [rbx]
mov byte [rdx + rbx], cl
inc rbx
test cl, cl
jne 0x140002667
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
movsxd rdx, r13d
lea r9, [rsp + 0x40]
add rdx, rdi
mov r8d, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x40]
mov rcx, rdi
add eax, r13d
mov byte [rax + rdi], 0
call fcn.140001834
mov rcx, rdi
call fcn.1400098ac
jmp 0x1400026ca
lea rcx, str.Out_of_memory_
call fcn.140001834
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, r12d
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140009080
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140002990
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
xor r9d, r9d
mov rsi, rdx
mov dword [rax - 0x20], 0x80
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rax - 0x28], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400029d9
xor eax, eax
jmp 0x140002a42
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov rcx, rbx
lea r8d, [r9 + 2]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 0xffffffffffffffff
je 0x1400029d5
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsi], ebp
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140002acc
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x160
mov rax, qword [0x1400342a0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r13, qword [rsp + 0x1c0]
mov eax, edx
xor r14d, r14d
sub edx, dword [rax + rcx - 6]
mov r12, r9
sub edx, dword [rax + rcx - 0xa]
mov qword [r13], r14
mov qword [r9], r14
sub edx, 0x22
movsxd rbx, edx
add rbx, rcx
cmp dword [rax + rcx - 0x16], 0x6054b50
jne 0x140002c41
cmp dword [rbx], 0x1234567b
je 0x140002b41
lea rdx, str.Invalid_cfgdata_magic_number__see_bdist_wininst.py_
xor ecx, ecx
call fcn.14000270c
jmp 0x140002c43
cmp edx, r14d
jl 0x140002c41
cmp dword [rbx + 8], r14d
je 0x140002b68
movsxd rax, dword [rbx + 4]
mov rcx, rbx
sub rcx, rax
movsxd rax, dword [rbx + 8]
sub rcx, rax
mov qword [0x140036b58], rcx
sub edx, dword [rbx + 8]
lea rdi, [rbx + 4]
mov ebp, 0x104
sub edx, dword [rdi]
mov rcx, rbp
mov dword [r8], edx
movsxd rax, dword [rdi]
sub rbx, rax
call fcn.14000993c
mov rsi, rax
cmp rax, r14
je 0x140002c41
lea rdx, [rsp + 0x40]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, r14d
je 0x140002c2d
lea rdx, [0x140027d08]
lea rcx, [rsp + 0x40]
mov r9, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
cmp eax, r14d
je 0x140002c2d
mov r9d, dword [rdi]
xor r8d, r8d
mov qword [rsp + 0x30], r14
lea ecx, [r8 + 2]
mov rdx, rsi
mov word [rsp + 0x28], r14w
mov word [rsp + 0x20], r14w
call fcn.1400010f0
mov rbp, rax
cmp rax, r14
je 0x140002c41
movsxd r8, dword [rdi]
mov rdx, rbx
mov rcx, rax
call fcn.14000a6c0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
add rcx, rbx
call fcn.14001e864
mov rcx, rbp
mov qword [r13], rax
mov qword [r12], rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, 1
jmp 0x140002c43
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_create_temporary_file
mov ecx, eax
call fcn.14000270c
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140009080
add rsp, 0x160
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140003144
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x160
mov rax, qword [0x1400342a0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbp, rdx
lea rax, [rsp + 0x48]
mov rdi, r8
mov r12, rcx
lea rdx, str.SoftwarePythonPythonCore
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
xor esi, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400031a4
xor eax, eax
jmp 0x140003325
and qword [rsp + 0x38], rsi
and qword [rsp + 0x30], rsi
and qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rsi
mov dword [rsp + 0x40], 0x50
xor edx, edx
jmp 0x1400032f8
inc esi
mov dword [rsp + 0x40], 0x50
test rdi, rdi
je 0x140003203
cmp byte [rdi], 0
je 0x140003203
lea rdx, [rsp + 0x60]
mov rax, rdi
sub rdx, rdi
movzx ecx, byte [rax]
movzx r8d, byte [rax + rdx]
sub ecx, r8d
jne 0x1400031fb
inc rax
test r8d, r8d
jne 0x1400031e6
test ecx, ecx
jne 0x1400032de
lea r8, [rsp + 0x60]
lea rdx, str.Python_Version__s__found_in_registry_
lea rcx, [rsp + 0x100]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rsp + 0x60]
lea rdx, str.SoftwarePythonPythonCore_sInstallPath
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r11, [rsp + 0x50]
lea rdx, [rsp + 0xb0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400032de
mov ecx, 0x110
call fcn.14000993c
mov dword [rsp + 0x44], 0x105
mov rbx, rax
test rax, rax
je 0x1400032d3
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400032d3
lea r9, [rsp + 0x100]
xor r8d, r8d
mov edx, 0x180
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageA]
mov r9, rbx
mov edx, 0x19a
mov rcx, r12
movsxd r8, eax
mov qword [rbx + 0x108], rbp
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, esi
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400031c7
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140009080
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400040e8
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0xc8
mov rax, qword [0x1400342a0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea r9, [0x140027838]
lea r8, [0x140036900]
lea rdx, str.runas
xor ecx, ecx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x140004160
lea rdx, str.Failed_to_start_elevated_process__ShellExecute_returned__d_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, str.Setup
lea rdx, [rsp + 0x30]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140009080
add rsp, 0xc8
ret

Function at 0x140004198
Capabilities:
Create process on windows
Resume thread
Self delete

Disassembly:
push rbx
sub rsp, 0x310
mov rax, qword [0x1400342a0]
xor rax, rsp
mov qword [rsp + 0x300], rax
lea rdx, [rsp + 0xe0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0xe0]
lea rdx, str._s.bat
lea rcx, [rsp + 0x1f0]
call fcn.14000c5f0
lea rdx, [0x140028384]
lea rcx, [rsp + 0x1f0]
call fcn.14000c580
lea rdx, str.:Repeat_n
mov rcx, rax
mov rbx, rax
call fcn.14000a190
lea r8, [rsp + 0xe0]
lea rdx, str.del___s__n
mov rcx, rbx
call fcn.14000a190
lea r8, [rsp + 0xe0]
lea rdx, str.if_exist___s__goto_Repeat_n
mov rcx, rbx
call fcn.14000a190
lea r8, [rsp + 0x1f0]
lea rdx, str.del___s__n
mov rcx, rbx
call fcn.14000a190
mov rcx, rbx
call fcn.14000ab20
mov ebx, 0x68
lea rcx, [rsp + 0x70]
mov r8, rbx
xor edx, edx
call fcn.140008a00
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x48], rax
xor ebx, ebx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [0x1400276a8]
lea rdx, [rsp + 0x1f0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x44
mov dword [rsp + 0xac], 1
mov word [rsp + 0xb0], bx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
je 0x140004325
mov rcx, qword [rsp + 0x58]
lea edx, [rbx - 0xf]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea edx, [rbx + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.140009080
add rsp, 0x310
pop rbx
ret
Function at 0x140004340
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
call fcn.14001e864
mov edx, 0x5b
mov rcx, rax
mov rbp, rax
call fcn.1400089d0
mov rdi, rax
test rax, rax
je 0x140004438
lea rcx, [rax + 1]
mov edx, 0x5d
call fcn.1400089d0
mov rbx, rax
test rax, rax
je 0x140004438
lea rcx, [rax + 1]
mov edx, 0xa
mov byte [rax], 0
call fcn.1400089d0
test rax, rax
je 0x1400043ab
mov byte [rax], 0
mov rcx, qword [section..data]
lea rax, [rsp + 0x48]
lea rdx, [rdi + 1]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400043f1
call qword [sym.imp.USER32.dll_GetFocus]
lea r8, str.Could_not_open_key
xor r9d, r9d
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140004430
mov rcx, qword [rsp + 0x48]
lea rdx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x140004425
cmp eax, 2
je 0x140004425
call qword [sym.imp.USER32.dll_GetFocus]
lea r8, str.Could_not_delete_key
xor r9d, r9d
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call fcn.1400098ac
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140004450
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
call fcn.14001e864
mov edx, 0x5b
mov rcx, rax
mov rbp, rax
call fcn.1400089d0
mov rdi, rax
test rax, rax
je 0x14000454c
lea rcx, [rax + 1]
mov edx, 0x5d
call fcn.1400089d0
mov rbx, rax
test rax, rax
je 0x14000454c
lea rcx, [rax + 1]
mov edx, 0x3d
mov byte [rax], 0
call fcn.1400089d0
test rax, rax
je 0x14000454c
mov byte [rax], 0
mov rcx, qword [section..data]
lea rax, [rsp + 0x48]
lea rdx, [rdi + 1]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140004505
call qword [sym.imp.USER32.dll_GetFocus]
lea r8, str.Could_not_open_key
xor r9d, r9d
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140004544
mov rcx, qword [rsp + 0x48]
lea rdx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x140004539
cmp eax, 2
je 0x140004539
call qword [sym.imp.USER32.dll_GetFocus]
lea r8, str.Could_not_delete_value
xor r9d, r9d
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call fcn.1400098ac
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140004564
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov edx, 0x3a
call fcn.1400089d0
mov rbx, rax
test rax, rax
je 0x140004594
inc rbx
movsx ecx, byte [rbx]
call fcn.14000ccfc
test eax, eax
jne 0x14000457c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
add rsp, 0x20
pop rbx
ret
Function at 0x14000459c
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x20
mov edx, 0x3a
call fcn.1400089d0
mov rbx, rax
test rax, rax
je 0x1400045cc
inc rbx
movsx ecx, byte [rbx]
call fcn.14000ccfc
test eax, eax
jne 0x1400045b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add rsp, 0x20
pop rbx
ret
Function at 0x140004ca4
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13d, edx
lea rdx, str.Py_Initialize
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_SetProgramName
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_Finalize
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyRun_SimpleString
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PySys_GetObject
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_OptimizeFlag
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
cmp qword [0x1400358d8], rcx
jne 0x140004d42
xor eax, eax
jmp 0x140004d89
cmp rdi, rcx
je 0x140004d86
cmp rsi, rcx
je 0x140004d86
cmp rbp, rcx
je 0x140004d86
cmp r12, rcx
je 0x140004d86
cmp r14, rcx
je 0x140004d86
cmp rax, rcx
je 0x140004d86
cmp r13d, ecx
setne cl
mov dword [rax], ecx
lea rcx, [0x140036900]
call rsi
call rdi
mov edx, r13d
mov rcx, r12
call fcn.140004b44
mov ebx, eax
call rbp
mov eax, ebx
jmp 0x140004d89
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret