joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004180c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14004183c
xor eax, eax
jmp 0x1400418ff
mov rbp, rbx
cmp word [rax], si
je 0x140041861
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140041848
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140041844
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14004172c
movsxd r14, eax
test eax, eax
jne 0x14004189f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140041835
mov rcx, r14
call fcn.14003cadc
mov rdi, rax
test rax, rax
jne 0x1400418b8
xor ecx, ecx
call fcn.14003cb3c
jmp 0x140041894
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14004172c
test eax, eax
jne 0x1400418e9
mov rcx, rdi
call fcn.14003cb3c
jmp 0x1400418f3
xor ecx, ecx
call fcn.14003cb3c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14004538c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140034a74
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140045416
cmp byte [rbp - 0x21], r15b
je 0x140045411
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14004544c
call fcn.14003d248
test eax, eax
jne 0x140045438
cmp byte [rbp - 0x21], r15b
je 0x140045430
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14004544c
cmp byte [rbp - 0x21], r15b
je 0x140045449
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400400b8
test eax, eax
jne 0x1400454ec
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140034a74
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14004548b
cmp byte [rbp - 0x21], r15b
je 0x1400454c0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400454c0
call fcn.14003d248
test eax, eax
jne 0x1400454ac
cmp byte [rbp - 0x21], r15b
je 0x1400454a5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400454c0
cmp byte [rbp - 0x21], r15b
je 0x1400454bd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400400b8
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400454ec
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400454ef
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400454fd
mov rcx, rdi
call fcn.14003cb3c
cmp byte [rbp + 0x3f], r15b
je 0x14004550c
mov rcx, qword [rbp + 0x27]
call fcn.14003cb3c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140048470
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140048498
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140048498
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14001bda0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp rdx, 1
je 0x14001bde2
mov rdi, rdx
lea rax, [rdx - 1]
test rdx, rax
je 0x14001bdc7
mov rcx, rdi
call fcn.140046860
mov rdi, rax
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x14001bde9
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x140095ea0
mov edi, 2
jmp 0x14001bdc7
jb 0x14001bdf3
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x14001be03
cvtsi2ss xmm0, rax
jmp 0x14001be18
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.140094200
cvttss2si rcx, xmm0
movss xmm1, dword [0x1400dbdc0]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rbx, 3
jb 0x14001beca
mov rcx, rbx
shr rcx, 1
movabs r8, 0x5555555555555555
and r8, rcx
mov rdx, rbx
sub rdx, r8
movabs r8, 0x3333333333333333
mov rcx, rdx
shr rcx, 2
and rdx, r8
and rcx, r8
add rcx, rdx
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x14001beca
cmp rax, 2
jb 0x14001bed2
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x14001bed2
mov rcx, rax
call fcn.140046860
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rbx
jae 0x14001bdeb
jmp 0x14001bdd0
Function at 0x14001dc70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14001dcc3
mov al, byte [rbp + 0x60]
movzx edx, bl
mov rbx, qword [rcx]
mov dword [rsp + 0x28], edx
mov byte [rsp + 0x20], al
mov rdx, rsi
mov r8, rdi
call qword [rbx + 0x30]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea r14, [rbp - 0x20]
mov rcx, r9
mov rdx, r14
call fcn.140047110
lea rdx, [0x1400f9308]
mov rcx, r14
call fcn.1400478e0
mov r14, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14001dcfc
mov rax, qword [rcx]
call qword [rax + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x1400dba00]
movaps xmmword [r15], xmm0
mov rax, qword [r14]
xor bl, 1
movzx ebx, bl
mov rcx, r14
mov rdx, r15
call qword [rax + rbx*8 + 0x28]
movzx r9d, byte [r15 + 0x17]
test r9b, r9b
mov rcx, qword [r15]
mov r8, qword [r15 + 8]
mov rax, r9
cmovs rax, r8
test rax, rax
je 0x14001ddb3
test r9b, r9b
mov rbx, r15
cmovs rbx, rcx
test rdi, rdi
je 0x14001dda1
mov al, byte [rbx]
movzx eax, al
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14001dda5
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
cmp eax, 0xffffffff
jne 0x14001dd76
xor edi, edi
mov r9b, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
inc rbx
test r9b, r9b
mov rax, r15
cmovs rax, rcx
movzx edx, r9b
cmovs rdx, r8
add rdx, rax
cmp rbx, rdx
jne 0x14001dd51
jmp 0x14001ddb3
xor edi, edi
jmp 0x14001dd82
mov r8, qword [rdi]
mov rcx, rdi
mov edx, eax
call qword [r8 + 0x60]
jmp 0x14001dd6f
shr r9b, 7
mov qword [rsi], rdi
test r9b, r9b
je 0x14001dcb3
call fcn.1400689c0
jmp 0x14001dcb3

Function at 0x140025960
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1400fa028]
test rdi, rdi
jne 0x140025a03
mov ecx, 0x48
call fcn.140068984
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.140068984
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x1400fa028], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140025a25
mov rcx, rax
call fcn.140081c78
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.140025a30
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140069700
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
int3
Function at 0x140026bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x78], rax
movzx eax, byte [0x1400fa030]
and eax, 1
neg rax
cmp rax, 0xfffffffffffffffd
je 0x140026d57
mov qword [rsp + 0x40], rdx
mov rbx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov rdi, qword [rcx + 8]
xor r13d, r13d
lea r12, [0x1400de190]
movabs rcx, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x1400dba00]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x48], rbx
mov rbx, qword [rsp + 0x48]
mov rax, r13
shl rax, 4
mov qword [rsp + 0x70], rcx
movaps xmmword [rsp + 0x60], xmm6
mov rdx, qword [rax + r12]
mov rbp, qword [rax + r12 + 8]
mov byte [rsp + 0x77], bpl
mov r8, rbp
add r8, rbp
mov r15, rsi
mov rcx, rsi
call fcn.14006bc80
mov word [rsp + rbp*2 + 0x60], 0
movzx eax, byte [rsp + 0x77]
mov rcx, rax
test al, al
jns 0x140026c79
mov rcx, qword [rsp + 0x68]
cmp rdi, rcx
jb 0x140026db1
mov r14b, 1
test rcx, rcx
mov rsi, r15
je 0x140026dbc
mov rdx, rsi
test al, al
jns 0x140026c9d
mov rdx, qword [rsp + 0x60]
xor ebp, ebp
movzx edi, word [rbx + rbp*2]
cmp di, word [rdx + rbp*2]
jne 0x140026cee
inc rbp
cmp rcx, rbp
jne 0x140026c9f
mov rbp, rcx
test al, al
js 0x140026dc3
test r14b, r14b
jne 0x140026cf8
mov qword [rsp + 0x28], rbp
inc r13
movzx eax, byte [0x1400fa030]
xor rax, 3
cmp r13, rax
mov rdi, qword [rsp + 0x30]
movabs rcx, 0xaaaaaaaaaaaaaaaa
jb 0x140026c31
jmp 0x140026d57
xor r14d, r14d
mov rbp, qword [rsp + 0x28]
jmp 0x140026cb4
test rbp, rbp
je 0x140026d57
mov rsi, qword [rsp + 0x38]
cmp rbp, qword [rsi + 8]
mov rdi, qword [rsp + 0x40]
je 0x140026d57
lea rax, [0x1400de1c0]
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], 1
movups xmm0, xmmword [rsi]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
xor r8d, r8d
call fcn.14004fcf0
mov rdx, qword [rsi + 8]
sub rdx, rbp
jb 0x140026dd5
sub rax, rbp
mov rcx, qword [rdi + 8]
cmp rdx, rax
cmovb rax, rdx
cmp rax, rcx
je 0x140026d84
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140069700
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov bl, 1
test rcx, rcx
je 0x140026d59
mov rax, qword [rdi]
add rbp, rbp
add rbp, qword [rsi]
xor edx, edx
mov rdi, rbp
movzx ebp, word [rbp + rdx*2]
cmp bp, word [rax + rdx*2]
jne 0x140026d57
inc rdx
cmp rcx, rdx
mov rbp, rdi
jne 0x140026d96
jmp 0x140026d59
xor r14d, r14d
mov rsi, r15
jmp 0x140026cf1
xor ebp, ebp
jmp 0x140026cb4
mov rcx, qword [rsp + 0x60]
call fcn.1400689c0
mov rsi, r15
jmp 0x140026cbc
int3
Function at 0x140027bb0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, r8
mov r14, rdx
mov r12, rcx
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0xd8], rax
test r8, r8
je 0x140027bfb
cmp byte [rsi + 0x17], 0
js 0x140027dc4
xor eax, eax
mov byte [rsi], al
mov byte [rsi + 0x17], al
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.14007f2d4
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x80]
mov qword [rdi + 0x50], rax
movaps xmm0, xmmword [0x1400dba00]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.ReadStreamToStringWithMaxSize
lea r8, str..._.._base_files_file_util.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0xc8
call fcn.14004fef0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140050370
xorps xmm6, xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
mov dword [rbx + 0x30], 0
mov rcx, r12
call fcn.1400783b0
mov ecx, eax
call fcn.14007840c
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140027dd7
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov edi, 0xffff
cmovg rdi, rax
cmp rdi, r14
cmova rdi, r14
lea r15, [rsp + 0x20]
movaps xmmword [r15], xmm6
mov qword [r15 + 0x10], 0
inc rdi
xor ebx, ebx
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
call fcn.140048ac0
mov r13d, 0x10000
cmp byte [rsp + 0x37], 0
mov rcx, r15
jns 0x140027cfc
mov rcx, qword [rsp + 0x20]
add rcx, rbx
mov edx, 1
mov r8, rdi
mov r9, r12
call fcn.14007f054
test rax, rax
je 0x140027d3d
mov rcx, r14
sub rcx, rbx
cmp rcx, rax
jb 0x140027de1
test rbx, rbx
cmove rdi, r13
add rbx, rax
mov rcx, r12
call fcn.14007ec00
test eax, eax
je 0x140027de8
mov rcx, r12
call fcn.14007ec2c
test eax, eax
sete dil
mov r14, rbx
test rsi, rsi
je 0x140027d83
movups xmm0, xmmword [rsi]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x30]
mov qword [rsi + 0x10], rcx
movaps xmm1, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.140048ac0
cmp byte [rsp + 0x37], 0
js 0x140027dfe
lea rcx, [rsp + 0x80]
call fcn.1400503d0
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140069700
mov eax, edi
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi]
mov byte [rax], 0
mov qword [rsi + 8], 0
jmp 0x140027bfb
mov edi, 0xffff
jmp 0x140027cbc
xor edi, edi
jmp 0x140027d4e
lea rdx, [rbx + rdi]
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.140048ac0
jmp 0x140027ced
mov rcx, qword [rsp + 0x20]
call fcn.1400689c0
jmp 0x140027d8a
Function at 0x140027e90
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.140049830
test al, al
je 0x140027ee9
call fcn.140049820
mov rdi, rax
lea rbx, [0x1400de7ae]
mov rcx, rax
mov rdx, rbx
call fcn.1400498d0
test al, al
jne 0x140027f18
lea rdx, str.vmodule
mov rcx, rdi
call fcn.1400498d0
test al, al
jne 0x140027f18
mov eax, dword [rsi]
mov dword [0x1400f5eb8], eax
mov bl, 1
test al, 1
jne 0x140027fd9
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140069700
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp qword [0x1400fa038], 0
jne 0x14002806a
mov rax, qword [0x1400fa040]
mov qword [0x1400fa038], rax
mov ecx, 0x20
call fcn.140068984
mov r14, rax
lea rcx, str.vmodule
lea r15, [rsp + 0x48]
mov qword [r15], rcx
call fcn.1400814e0
mov qword [r15 + 8], rax
lea r12, [rsp + 0x58]
mov rcx, rdi
mov rdx, r12
mov r8, r15
call fcn.1400499e0
lea r15, [rsp + 0x20]
mov qword [r15], rbx
mov rcx, rbx
call fcn.1400814e0
mov qword [r15 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
mov r8, r15
call fcn.1400499e0
lea r9, [0x1400fa048]
mov rcx, r14
mov rdx, rbx
mov r8, r12
call fcn.1400ae580
mov qword [0x1400fa040], r14
cmp byte [rbx + 0x17], 0
jns 0x140027fbf
mov rcx, qword [rsp + 0x30]
call fcn.1400689c0
cmp byte [rsp + 0x6f], 0
jns 0x140027ee9
mov rcx, qword [rsp + 0x58]
call fcn.1400689c0
jmp 0x140027ee9
mov rcx, qword [0x1400fa070]
test rcx, rcx
jne 0x140027ff3
mov rcx, qword [0x1400fa050]
test rcx, rcx
je 0x140028017
jmp 0x140028039
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400fa070], 0
mov rcx, qword [0x1400fa050]
test rcx, rcx
jne 0x140028039
and byte [0x1400f5eb8], 0xfe
mov ecx, 0x18
call fcn.140068984
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1400fa050], rax
mov rdx, qword [rsi + 8]
call fcn.140024140
cmp dword [rsi + 0x14], 0
jne 0x14002805e
mov rcx, qword [0x1400fa050]
cmp byte [rcx + 0x17], 0
jns 0x140028058
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.1400ac5c0
mov ebx, eax
jmp 0x140027efb
int3
Function at 0x14002a5c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x1400dba00]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1fa
call fcn.14004fef0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140050370
cmp byte [rdi + 0x17], 0
jns 0x14002a644
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.1400503d0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140069700
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x14002a680
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.14006c090
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14002a71f
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.140081c78
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.14004a4d0
lea rsi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.140027aa0
mov rcx, r14
mov rdx, rsi
call fcn.14004a5c0
mov rcx, rsi
call fcn.14004a5b0
mov rcx, rbx
call fcn.14004a5b0
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140069700
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14002a750
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14006c090
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002a7e5
cmp word [rsp + 0x70], 0
je 0x14002a7e5
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.140081c78
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.14004a4d0
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140069700
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1400dba00]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.14004a490
mov rcx, rdi
call fcn.14002a680
test al, al
je 0x14002a825
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14004a4b0
jmp 0x14002a844
lea rax, [0x1400de444]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.14004a4d0
lea rcx, [rsp + 0x40]
call fcn.14004a5b0
jmp 0x14002a7c7
Function at 0x14002b6d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea rdi, [rsp + 0x38]
mov dword [rdi], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14002b743
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14002b743
cmp dword [rsp + 0x38], 4
jne 0x14002b743
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140069700
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x14002b760
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.140069690
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rsi, [rsp + 0x840]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.14006c090
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002b813
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14002b817
lea rdx, [rsp + 0x840]
mov rcx, r14
call fcn.140024f20
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140069700
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x14002b7f4
cmp eax, 2
jne 0x14002b85c
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.14006c090
lea rcx, [rsp + 0x840]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
dec eax
cmp eax, 0x3ff
ja 0x14002b863
lea rdx, [rsp + 0x40]
jmp 0x14002b7ea
mov edi, 0x3f4
jmp 0x14002b7f4
mov edi, 0xea
jmp 0x14002b7f4

Function at 0x14002b870
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140069700
mov eax, esi
add rsp, 0x40
pop rsi
ret
xor r8d, r8d
test edx, edx
cmovns r8d, edx
lea rdx, str.PWALauncherResult
jmp 0x14002b870