joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d26c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor eax, eax
mov rbx, rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x28], rax
mov r8d, 0x11c
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.140187ea0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1400d2745
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1400d2745
xor eax, eax
jmp 0x1400d28c4
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x1400d2770
call rax
jmp 0x1400d2776
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rdx, qword [rsp + 0x20]
movzx ecx, dx
test ecx, ecx
je 0x1400d27aa
cmp ecx, 6
je 0x1400d279e
xor r8d, r8d
mov eax, 2
cmp ecx, 9
cmovne eax, r8d
mov dword [rbx + 0x332b8], eax
jmp 0x1400d27b4
mov dword [rbx + 0x332b8], 3
jmp 0x1400d27b4
mov dword [rbx + 0x332b8], 1
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1400d28bf
sub eax, 1
je 0x1400d288f
cmp eax, 1
jne 0x1400d273e
mov eax, dword [rsp + 0x54]
cmp eax, 0xa
jne 0x1400d27f0
cmp dword [rsp + 0x58], 0
jne 0x1400d273e
mov eax, InitCommonControls
jmp 0x1400d28c4
cmp eax, 6
jne 0x1400d2838
mov eax, dword [rsp + 0x58]
cmp eax, 3
jne 0x1400d2808
mov eax, InitCommonControls
jmp 0x1400d28c4
cmp eax, 2
jne 0x1400d2817
mov eax, 0xc
jmp 0x1400d28c4
cmp eax, 1
jne 0x1400d2826
mov eax, 0xb
jmp 0x1400d28c4
test eax, eax
jne 0x1400d273e
mov eax, 0xa
jmp 0x1400d28c4
cmp eax, 5
jne 0x1400d287f
mov eax, dword [rsp + 0x58]
cmp eax, 2
jne 0x1400d2864
cmp byte [rsp + 0x16a], 1
jne 0x1400d285d
cmp dx, 9
jne 0x1400d285d
mov eax, 9
jmp 0x1400d28c4
mov eax, 8
jmp 0x1400d28c4
cmp eax, 1
jne 0x1400d2870
mov eax, 7
jmp 0x1400d28c4
test eax, eax
jne 0x1400d273e
mov eax, 6
jmp 0x1400d28c4
cmp eax, 4
ja 0x1400d273e
mov eax, 5
jmp 0x1400d28c4
cmp dword [rsp + 0x54], 4
jne 0x1400d273e
mov ecx, dword [rsp + 0x58]
test ecx, ecx
jne 0x1400d28a7
lea eax, [rcx + 2]
jmp 0x1400d28c4
cmp ecx, 0xa
jne 0x1400d28b1
lea eax, [rcx - 7]
jmp 0x1400d28c4
cmp ecx, 0x5a
jne 0x1400d273e
lea eax, [rcx - 0x56]
jmp 0x1400d28c4
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140168660
add rsp, 0x180
pop rbx
ret
Function at 0x1400d71e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rbp, qword [r8 + 0x18]
mov r9, r8
mov rbx, qword [r8 + 0x10]
mov r15, rdx
mov r11, rcx
cmp rbp, 8
jb 0x1400d7216
mov r8, qword [r8]
xor edi, edi
lea r10, [rbx + rbx]
movabs rdx, 0xcbf29ce484222325
mov ecx, edi
test r10, r10
je 0x1400d7254
movabs rsi, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, rsi
cmp rcx, r10
jb 0x1400d7240
mov rcx, qword [r11 + 0x30]
mov r13d, 1
mov rsi, qword [r11 + 8]
and rcx, rdx
mov rdx, qword [r11 + 0x18]
mov rax, rcx
add rax, rax
mov r10, qword [rdx + rax*8]
lea rax, [rcx + rcx]
mov r14, qword [rdx + rax*8]
lea r12, [rdx + rax*8]
nop
cmp r14, rsi
jne 0x1400d728a
mov rax, rsi
jmp 0x1400d7292
mov rax, qword [r12 + 8]
mov rax, qword [rax]
cmp r10, rax
je 0x1400d736b
cmp rbp, 8
jb 0x1400d72a6
mov rdx, qword [r9]
jmp 0x1400d72a9
mov rdx, r9
cmp qword [r10 + 0x28], 8
jb 0x1400d72b6
mov rcx, qword [r10 + 0x10]
jmp 0x1400d72ba
lea rcx, [r10 + 0x10]
mov r11, qword [r10 + 0x20]
mov r8, rbx
cmp r11, rbx
cmovb r8, r11
test r8, r8
jne 0x1400d72e1
mov r8d, edi
test r8d, r8d
jne 0x1400d72dc
cmp r11, rbx
jb 0x1400d72dc
jbe 0x1400d7307
mov r10, qword [r10]
jmp 0x1400d7280
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x1400d72f6
add rcx, 2
add rdx, 2
sub r8, r13
jmp 0x1400d72cb
cmp word [rcx], ax
mov r8d, r13d
mov eax, 0xffffffff
cmovb r8d, eax
jmp 0x1400d72d0
cmp qword [r10 + 0x28], 8
jb 0x1400d7314
mov rcx, qword [r10 + 0x10]
jmp 0x1400d7318
lea rcx, [r10 + 0x10]
cmp rbp, 8
jb 0x1400d7321
mov r9, qword [r9]
mov r8, qword [r10 + 0x20]
cmp rbx, r8
mov rdx, r8
cmovb rdx, rbx
test rdx, rdx
je 0x1400d7358
movzx eax, word [rcx]
cmp word [r9], ax
jne 0x1400d734c
add r9, 2
add rcx, 2
sub rdx, r13
jne 0x1400d7334
jmp 0x1400d7358
mov eax, 0xffffffff
cmovb r13d, eax
mov edi, r13d
test edi, edi
jne 0x1400d7363
cmp rbx, r8
jb 0x1400d7363
jbe 0x1400d7366
mov r10, rsi
mov qword [r15], r10
jmp 0x1400d736e
mov qword [r15], rsi
mov rbx, qword [rsp + 0x28]
mov rax, r15
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400d7950
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
xor esi, esi
mov qword [rbp - 9], rsi
mov qword [rbp - 1], rsi
mov qword [rbp - 1], 7
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
lea rdx, [rcx + 0x32f28]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp - 0x19]
call fcn.140006dd0
nop
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400d7a9e
lea rdx, [rbx + 0x330a8]
lea rax, [rbp - 0x19]
cmp rax, rdx
je 0x1400d79f2
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp - 0x19]
call fcn.140006dd0
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], rsi
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], rsi
mov word [rbp + 7], si
mov r8d, InitCommonControls
lea rdx, str.nativeLang.xml
lea rcx, [rbp + 7]
call fcn.140006f10
nop
lea r8, [rbp + 7]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.140028400
mov r8, qword [rbp + 0x3f]
cmp r8, 8
jb 0x1400d7a4c
inc r8
mov rdx, qword [rbp + 0x27]
lea rcx, [rbp + 0x27]
call fcn.140007680
mov qword [rbp + 0x3f], 7
mov qword [rbp + 0x37], rsi
mov word [rbp + 0x27], si
mov r8, qword [rbp + 0x1f]
cmp r8, 8
jb 0x1400d7a76
inc r8
mov rdx, qword [rbp + 7]
lea rcx, [rbp + 7]
call fcn.140007680
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], rsi
mov word [rbp + 7], si
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400d7b09
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1400d7ab1
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov ecx, 0xa0
call fcn.140167f20
mov qword [rbp - 0x21], rax
test rax, rax
je 0x1400d7ace
mov rcx, rax
call fcn.140117140
jmp 0x1400d7ad1
mov rax, rsi
mov qword [rbx + 0x70], rax
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
mov rcx, rax
call fcn.140118320
movzx edi, al
test al, al
jne 0x1400d7b0c
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1400d7b05
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0x70], rsi
xor dil, dil
mov r8, qword [rbp - 1]
cmp r8, 8
jb 0x1400d7b26
inc r8
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp - 0x19]
call fcn.140007680
mov qword [rbp - 1], 7
mov qword [rbp - 9], rsi
mov word [rbp - 0x19], si
movzx eax, dil
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140168660
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400d7d50
Capabilities:
Check if file exists
Delete file

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x28]
call fcn.1400d18c0
nop
mov r8d, InitCommonControls
lea rdx, str.cloudchoice
lea rcx, [rsp + 0x28]
call fcn.140006a00
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400d7dc1
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x1400d7dde
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140007680
mov qword [rsp + 0x40], 7
xor eax, eax
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], ax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140168660
add rsp, 0x58
ret
Function at 0x1400d80d0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
lea rdx, [rbp - 0x48]
call fcn.1400d18c0
nop
mov r8d, 7
lea rdx, str.cloud_
lea rcx, [rbp - 0x48]
call fcn.140006a00
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400d814d
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r8d, 6
lea rdx, str.choice
lea rcx, [rbp - 0x48]
call fcn.140006a00
call fcn.14000cd40
xor esi, esi
mov qword [rsp + 0x20], rsi
or rbx, 0xffffffffffffffff
mov r9d, ebx
mov r8d, 0xfde9
mov rdx, rdi
mov rcx, rax
call fcn.14002d430
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 0x10], InitCommonControls
mov qword [rbp - 0x18], rsi
mov byte [rbp - 0x28], sil
cmp byte [rax], sil
jne 0x1400d81b0
mov ebx, esi
jmp 0x1400d81b9
inc rbx
cmp byte [rax + rbx], sil
jne 0x1400d81b0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140006ca0
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call fcn.14002d6d0
nop
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x1400d8241
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, 0x1000
jb 0x1400d823c
test cl, 0x1f
je 0x1400d820f
call fcn.14018acfc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400d821e
call fcn.14018acfc
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400d822d
call fcn.14018acfc
int3
cmp rcx, 0x27
jbe 0x1400d8239
call fcn.14018acfc
int3
mov rcx, rax
call fcn.140167f5c
mov qword [rbp - 0x10], InitCommonControls
mov qword [rbp - 0x18], rsi
mov byte [rbp - 0x28], 0
mov r8, qword [rbp - 0x30]
cmp r8, 8
jb 0x1400d826b
inc r8
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x48]
call fcn.140007680
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x38], rsi
mov word [rbp - 0x48], si
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140168660
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d8450
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
test rdx, rdx
je 0x1400d848c
cmp word [rdx], 0
je 0x1400d848c
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400d8470
add rcx, 0x33188
add rsp, 0x20
pop rdi
jmp fcn.140006f10
add rcx, 0x5e8
mov qword [rsp + 0x30], rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400d84d8
cmp word [rdi + 0x5e8], 0
jne 0x1400d84b8
xor r8d, r8d
lea rdx, [rdi + 0x5e8]
jmp 0x1400d850b
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdi + r8*2 + 0x5e8], 0
jne 0x1400d84c0
lea rdx, [rdi + 0x5e8]
jmp 0x1400d850b
lea rdx, [rdi + 0x330a8]
cmp qword [rdx + 0x18], 8
jb 0x1400d84e9
mov rdx, qword [rdx]
cmp word [rdx], 0
jne 0x1400d84f4
xor r8d, r8d
jmp 0x1400d850b
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400d8500
lea rcx, [rdi + 0x33188]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140006f10

Function at 0x1400d86a0
Capabilities:
Copy file

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov r8, rdx
lea rdx, [rsp + 0x28]
call fcn.1400d28e0
nop
cmp qword [rsp + 0x38], 0
jne 0x1400d86db
xor bl, bl
jmp 0x1400d8708
lea rdx, [rbx + 0x18]
cmp qword [rdx + 0x18], 8
jb 0x1400d86e9
mov rdx, qword [rdx]
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x1400d8725
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140007680
mov qword [rsp + 0x40], 7
xor eax, eax
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], ax
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140168660
add rsp, 0x50
pop rbx
ret
Function at 0x1400d98d0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x120
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov r15, rcx
mov rbx, qword [rcx + 0x38]
mov rdi, qword [rcx + 0x40]
cmp rbx, rdi
je 0x1400d9a3d
nop dword [rax]
movups xmm1, xmmword [rbx]
movups xmmword [rsp + 0x20], xmm1
psrldq xmm1, 8
movq rcx, xmm1
test cl, cl
je 0x1400d9a30
mov rbp, qword [rsp + 0x20]
test rbp, rbp
je 0x1400d9a30
cmp rbp, qword [r15 + 0x30]
je 0x1400d9a30
mov rax, rcx
shr rax, 0x10
shr rcx, 8
cmp al, cl
jne 0x1400d9997
lea rsi, [rbp + 0x30]
cmp qword [rsi + 0x18], 8
jb 0x1400d996f
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400d9a30
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400d9a30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400d9a30
lea rdx, [0x1401d3758]
mov rcx, rbp
call fcn.1401156e0
test rax, rax
je 0x1400d99b6
mov rdx, rax
mov rcx, rbp
call fcn.1401168c0
lea rdx, [0x1401d3758]
lea rcx, [rsp + 0x40]
call fcn.1401147f0
nop
mov rdx, rax
mov rcx, rbp
call fcn.1401159a0
nop
lea rcx, [rsp + 0x40]
call fcn.140114be0
lea rdx, [0x1401d3758]
mov rcx, rbp
call fcn.1401156e0
mov r12, rax
movzx edx, byte [rsp + 0x29]
movzx eax, byte [rsp + 0x2a]
cmp edx, eax
jae 0x1400d9a28
lea rsi, [rdx + 0x1ae]
lea rsi, [r15 + rsi*8]
sub eax, edx
mov r14d, eax
nop
mov r8, qword [rsi]
mov rdx, r12
mov rcx, r15
call fcn.1400d4090
lea rsi, [rsi + 8]
sub r14, 1
jne 0x1400d9a10
mov rcx, rbp
call fcn.140116990
add rbx, 0x10
cmp rbx, rdi
jne 0x1400d9920
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140168660
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400de260
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400de350
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov r8d, 0x1000002
mov qword [rsp + 0x58], rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
jne 0x1400de2e6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
movzx eax, bx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
xor r9d, r9d
mov qword [rsp + 0x50], rbp
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rsi
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
test rax, rax
jne 0x1400de319
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
jmp 0x1400de340
mov rcx, rbp
call qword [sym.imp.dbghelp.dll_ImageNtHeader]
test rax, rax
je 0x1400de32b
movzx ebx, word [rax + 4]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
movzx eax, bx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400efa10
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
test dl, dl
lea rax, str.runas
lea r10, str.open
cmovne r10, rax
cmp qword [rcx + 0x58], 8
lea rax, [rcx + 0x40]
jb 0x1400efa36
mov rax, qword [rax]
cmp qword [rcx + 0x38], 8
lea r9, [rcx + 0x20]
jb 0x1400efa44
mov r9, qword [r9]
cmp qword [rcx + 0x18], 8
jb 0x1400efa4e
mov rcx, qword [rcx]
mov r8, rcx
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rdx, r10
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x38
ret
Function at 0x1400f2600
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x90
xor r9d, r9d
mov dword [rsp + 0x20], 4
mov rdi, rcx
mov edx, 0x110a
mov rcx, qword [rcx + 0xa8]
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0xa8]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov edx, 0x113e
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0x28]
lea r9, [rsp + 0x58]
mov rcx, qword [rdi + 0xa8]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], 6
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsp + 0x7c]
cmp eax, 1
jbe 0x1400f2733
cmp eax, 2
je 0x1400f2733
cmp qword [rsp + 0x88], 0
je 0x1400f2733
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x1400f272b
mov dword [rsp + 0x20], 0x22
cmp qword [rbx + 0x18], 8
jb 0x1400f26c3
mov rcx, qword [rbx]
jmp 0x1400f26c6
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400f2701
cmp qword [rbx + 0x18], 8
jb 0x1400f26da
mov rbx, qword [rbx]
mov rcx, qword [rdi + 0x10]
mov r9, rbx
xor r8d, r8d
mov edx, 0x835
call qword [sym.imp.USER32.dll_PostMessageW]
mov dword [rsp + 0x44], 5
mov dword [rsp + 0x48], 5
jmp 0x1400f2711
mov dword [rsp + 0x44], 6
mov dword [rsp + 0x48], 6
mov rcx, qword [rdi + 0xa8]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x113f
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x1400f2740
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rbp, rcx
mov ecx, 0xa0
call fcn.140167f20
mov qword [rsp + 0x38], rax
xor r12d, r12d
test rax, rax
je 0x1400f279b
mov rdx, rsi
mov rcx, rax
call fcn.140114620
mov rbx, rax
jmp 0x1400f279e
mov rbx, r12
mov rcx, rbx
call fcn.140115c30
movzx r15d, al
test al, al
jne 0x1400f27c7
test rbx, rbx
je 0x1400f27c0
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
xor al, al
jmp 0x1400f2986
lea rdx, [0x1401d3758]
mov rcx, rbx
call fcn.1401156e0
test rax, rax
je 0x1400f27ae
lea rdx, [0x140203670]
mov rcx, rax
call fcn.140115950
mov rdi, rax
test rax, rax
je 0x1400f27ae
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400f27ae
lea rcx, [rbp + 0x90]
call fcn.1401223c0
cmp word [rsi], 0
jne 0x1400f2816
mov r8, r12
jmp 0x1400f282b
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rsi + r8*2], 0
jne 0x1400f2820
lea rcx, [rbp + 0x130]
mov rdx, rsi
call fcn.140006f10
call fcn.14000cdd0
lea rcx, str.WorkspaceRootName
mov qword [rsp + 0x20], rcx
lea r9, str.ProjectManager
lea r8, str.Workspace
lea rdx, [rsp + 0x40]
mov rcx, qword [rax + 0x332c0]
call fcn.14006fdc0
nop
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, 0xffffffffffff0000
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.1401216b0
mov rsi, rax
test rdi, rdi
je 0x1400f28a3
cmp dword [rdi + 0x18], 1
mov rcx, rdi
je 0x1400f28a6
mov rcx, r12
lea rdx, [0x1401d3868]
call fcn.140114f30
mov rdx, rax
mov qword [rsp + 0x20], r12
mov r9d, 2
mov r8, rsi
lea rcx, [rbp + 0x90]
call fcn.1401216b0
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.1400f0820
lea rdx, [0x140203670]
mov rcx, rdi
call fcn.140115ce0
mov rdi, rax
test rax, rax
jne 0x1400f2895
mov byte [rbp + 0x170], al
xor r9d, r9d
xor r8d, r8d
mov edx, 0x110a
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rbp + 0x90]
call fcn.140122e90
mov r9, rsi
mov edx, 0x1102
lea r8d, [rdi + 2]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.USER32.dll_SendMessageW]
test rbx, rbx
je 0x1400f2951
mov rax, qword [rbx]
lea edx, [rdi + 1]
mov rcx, rbx
call qword [rax]
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x1400f296e
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140007680
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r12
mov word [rsp + 0x40], r12w
movzx eax, r15b
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140168660
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400f4cb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub rsp, 0x298
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rsp + 0x58]
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400f4dbc
cmp dword [rsp + 0x60], 2
mov dword [rsp + 0x50], 0x208
jne 0x1400f4d77
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401d3618]
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400f4d77
mov eax, dword [rsp + 0x50]
mov r9d, 1
mov rdx, qword [str.Notepad_backup]
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [str.Notepad_file]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x58]
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov rax, qword [str.Notepad_file]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140168660
add rsp, 0x298
ret