joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140204aac
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140204b13
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140204b27
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140204b27
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call qword [case.0x14001d845.0]
jmp 0x140204b2c
cmp dword [rcx + 8], 0
je 0x140204b27
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140204b2c
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1402051c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x150], 0
mov rbx, rcx
jne 0x1402052a9
cmp qword [rcx + 0x130], 0
je 0x1402052a9
call fcn.1401bf5e4
mov rdx, qword [rbx + 0x130]
mov r8d, 5
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1402052a9
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1402052a9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x1402052a9
call fcn.1401bf5e4
mov rdi, qword [rax + 0x68]
test rdi, rdi
je 0x1402052a9
mov ecx, 0x20
call fcn.1401bcc90
mov rcx, qword [rdi]
mov rbp, rax
mov r8, rsi
mov rdx, rbp
mov rax, qword [rcx + 0x28]
mov rcx, rdi
call qword [case.0x14001d845.0]
mov rdx, qword [rbx + 0x158]
mov qword [rbx + 0x150], rbp
test rdx, rdx
je 0x1402052a2
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x30]
call qword [case.0x14001d845.0]
mov rcx, qword [rbx + 0x158]
mov edx, 0x20
call fcn.14000e3f0
mov qword [rbx + 0x158], rbp
mov rax, qword [rbx + 0x150]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140206340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r9
mov r15, r8
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140206401
mov esi, 0x811c9dc5
xor ebx, ebx
mov rcx, rdx
call fcn.140286900
mov r8, rax
mov eax, 0xcccccccd
mul r8d
shr edx, 3
inc edx
test r8d, r8d
je 0x1402063a4
movzx ecx, word [rdi + rbx*2]
imul esi, esi, 0x1000193
xor esi, ecx
add ebx, edx
cmp ebx, r8d
jb 0x140206391
mov dword [r14], esi
xor edx, edx
mov eax, esi
div dword [rbp + 0x10]
mov dword [r15], edx
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1402063e1
mov rbx, qword [rbx + rdx*8]
jmp 0x1402063dc
mov eax, dword [r14]
cmp dword [rbx + 8], eax
jne 0x1402063d9
mov rdx, rdi
mov rcx, qword [rbx + 0x10]
call fcn.14028f2a0
nop
test eax, eax
je 0x1402063fc
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1402063c0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov rax, rbx
jmp 0x1402063e3
call fcn.1401beac8
int3

Function at 0x140206a50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.14000e0c4
nop
cmp rbx, 0xffffffff80000000
jne 0x140206ad8
call fcn.1401bf658
cmp eax, 1
jne 0x140206ad8
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.1400143cc
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000d830
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140206ad1
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001d845.0]
mov rbx, 0xffffffff80000001
mov r9, rdi
mov r8, rsi
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140206b14
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14001d845.0]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140206b28
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
mov esi, r8d
mov rbx, rcx
lea rcx, [rsp + 0x50]
call fcn.14000e0c4
nop
cmp rbx, 0xffffffff80000000
jne 0x140206bb0
call fcn.1401bf658
cmp eax, 1
jne 0x140206bb0
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.1400143cc
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000d830
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140206ba9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001d845.0]
mov rbx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140206bf4
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14001d845.0]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140207014
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov r13, r8
mov edx, 1
mov r15, rcx
mov r12d, edx
mov r14d, edx
lea rdi, [rsi + 0x18]
cmp dword [rsi + 0x10], edx
jle 0x1402070ad
lea ebx, [rdx + 7]
lea ebp, [rdx + 0xf]
test r13, r13
je 0x140207072
mov rax, qword [r15 + 0x10]
cmp qword [rax + rbp + 8], r13
je 0x140207072
mov rax, qword [rdi]
cmp qword [rbx + rax], 0
je 0x140207097
xor r12d, r12d
jmp 0x140207097
mov rax, qword [rdi]
mov rcx, qword [rbx + rax]
test rcx, rcx
je 0x14020708f
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14001d845.0]
mov edx, 1
mov rax, qword [rdi]
and qword [rbx + rax], 0
add r14d, edx
add rbp, 0x10
add rbx, 8
cmp r14d, dword [rsi + 0x10]
jl 0x140207053
test r12d, r12d
je 0x1402070f5
lea rcx, [r15 + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [r15 + 0x18]
mov rdx, rsi
call fcn.1402073c8
lea rcx, [r15 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x14001d845.0]
mov ecx, dword [r15]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140208334
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x140412700]
xor rax, rsp
mov qword [rsp + 0x220], rax
xor ebp, ebp
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1402083ef
test rdx, rdx
je 0x1402083ef
mov rcx, rdx
call fcn.140286900
xor edx, edx
mov word [rsp + 0x20], bp
mov r8d, 0x1fe
lea rcx, [rsp + 0x22]
mov rsi, rax
call fcn.1402bf2e0
mov r8d, 0x100
cmp rsi, r8
ja 0x1402083c0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, esi
jne 0x1402083c0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1402083cc
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1402194b0
mov rbx, qword [rsp + 0x260]
add rsp, 0x230
pop rdi
pop rsi
pop rbp
ret
call fcn.1401beac8
int3
Function at 0x140209e58
Capabilities:
Identify system language via api

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140412700]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, ecx
xor esi, esi
mov rcx, qword [0x140444208]
mov r12, r9
mov r15, r8
mov r14, rdx
test rcx, rcx
jne 0x140209ec8
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140209eef
lea rdx, str.GetThreadPreferredUILanguages
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140444208], rax
jmp 0x140209ed1
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rbx, rax
test rbx, rbx
je 0x140209eef
mov r9, r12
mov r8, r15
mov rdx, r14
mov ecx, edi
mov rax, rbx
call qword [case.0x14001d845.0]
jmp 0x14020a031
mov dword [r14], esi
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
mov r8d, 7
mov ecx, esi
lea rdx, [rbp - 0x20]
call fcn.14020a474
lea rcx, [rbp - 0x20]
call fcn.140286900
mov edx, dword [r12]
lea r8, [rbp - 0x20]
mov rcx, r15
lea rdi, [rax + 1]
call fcn.1402932fc
inc dword [r14]
lea rdx, [rbp - 0x20]
and esi, 0x3ff
mov r8d, 7
mov ecx, esi
call fcn.14020a474
lea rcx, [rbp - 0x20]
call fcn.140286900
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
lea rbx, [rax + 1]
call fcn.1402932fc
inc dword [r14]
add rdi, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx esi, ax
mov r8d, 7
mov ecx, esi
lea rdx, [rbp - 0x20]
call fcn.14020a474
lea rcx, [rbp - 0x20]
call fcn.140286900
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
lea rbx, [rax + 1]
call fcn.1402932fc
inc dword [r14]
lea rdx, [rbp - 0x20]
and esi, 0x3ff
mov r8d, 7
mov ecx, esi
add rdi, rbx
call fcn.14020a474
lea rcx, [rbp - 0x20]
call fcn.140286900
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
lea rbx, [rax + 1]
call fcn.1402932fc
inc dword [r14]
lea rdx, [rbp - 0x20]
mov r8d, 7
mov ecx, 0x800
add rdi, rbx
call fcn.14020a474
lea rcx, [rbp - 0x20]
call fcn.140286900
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
mov rbx, rax
call fcn.1402932fc
inc dword [r14]
lea rcx, [rdi + rbx]
xor eax, eax
mov word [r15 + rcx*2 + 2], ax
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402194b0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140211280
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x1402112b2
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1402112b2
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.140217ba0
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1402112c4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1402112ea
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140204aac
jmp 0x140211356
cmp byte [0x140444268], 0
jne 0x14021132e
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14021131e
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140444260], rax
jmp 0x140211325
mov rax, qword [0x140444260]
mov byte [0x140444268], 1
jmp 0x140211335
mov rax, qword [0x140444260]
mov rdx, rdi
mov rcx, qword [rbx]
test rax, rax
je 0x14021134f
xor r9d, r9d
mov r8d, dword [rbx + 8]
call qword [case.0x14001d845.0]
jmp 0x140211356
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140213740
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x88
mov rdi, rcx
mov esi, 1
mov rax, qword [rcx + 0x20]
neg rax
sbb rdx, rdx
mov qword [rbp + 0x77], rdx
cmp qword [rcx + 0x20], 0
je 0x140213833
xor esi, esi
and qword [rbp + 0x17], rsi
and dword [rbp + 0x1f], esi
and qword [rbp + 0x27], rsi
mov rax, qword [rcx]
lea rdx, [rbp + 0xf]
mov rax, qword [rax + 0x40]
call qword [case.0x14001d845.0]
nop
mov rbx, qword [rax]
call fcn.1401bf5e4
xor edx, edx
mov rcx, qword [rax + 8]
call fcn.1402035b4
nop
and qword [rbp + 0x7f], rsi
lea rcx, [rbp + 0x67]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x7f]
mov qword [rsp + 0x38], rcx
and qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, eax
test eax, eax
jne 0x1402137ef
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x17], rax
and dword [rbp + 0x1f], ecx
mov eax, ecx
neg eax
sbb ebx, ebx
and ebx, ecx
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14021381c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001d845.0]
test ebx, ebx
je 0x140213922
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x140213833
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
add rsp, 0x88
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401bdd78
mov rcx, rax
test rax, rax
je 0x140213951
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001d845.0]
add rax, 0x18
mov qword [rbp + 0x6f], rax
call fcn.1401bdd78
mov rcx, rax
test rax, rax
je 0x140213946
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001d845.0]
add rax, 0x18
mov qword [rbp + 7], rax
lea rcx, [rdi + 8]
lea r9, [rbp + 7]
lea r8, [rbp + 0x6f]
lea rdx, [rbp + 0x77]
call fcn.1400312c4
mov rbx, qword [rbp + 7]
test rbx, rbx
je 0x1402138db
mov rcx, rbx
call fcn.140286900
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x6f]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1402138fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001d845.0]
nop
mov rdx, qword [rbp + 0x6f]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140213922
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001d845.0]
cmp qword [rbp + 0x77], 0
jne 0x140213841
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x14021393c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140213835
mov ecx, 0x80004005
call fcn.14000e344
nop
mov ecx, 0x80004005
call fcn.14000e344
int3
Function at 0x140216828
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
test r8, r8
jne 0x140216886
test rdx, rdx
jne 0x140216855
mov eax, ebx
jmp 0x14021685d
mov rcx, rdi
call fcn.140286900
add eax, eax
mov r9, rdi
mov r8d, 1
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, 0xffffffff80000000
call fcn.140206b28
test eax, eax
jne 0x1402168f3
mov eax, 1
jmp 0x1402168f5
xor r9d, r9d
lea r8, [rsp + 0x50]
mov rdx, rbp
mov rcx, 0xffffffff80000000
call fcn.1402067fc
test eax, eax
jne 0x1402168f3
test rdi, rdi
jne 0x1402168aa
mov eax, ebx
jmp 0x1402168b2
mov rcx, rdi
call fcn.140286900
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1402168f3
test edi, edi
sete bl
mov eax, ebx
jmp 0x1402168f5
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14021a330
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14021a37a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14021a37a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14021a37a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14021a37a
cmp dword [rcx + 0x84], 0xe
jbe 0x14021a37a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14021a37c
xor al, al
add rsp, 0x28
ret

Function at 0x14021c2c8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14021c302
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14021c307
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14021c350
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1403050c0]
cmp byte [rcx + rax], 0
je 0x14021c350
dec r8
sub rdx, 1
jne 0x14021c336
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140222730
Capabilities:
Check if file exists

Disassembly:
jmp 0x140222740
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x14022276c
xor r9d, r9d
lea rdx, str.D:devwinmerge_stableBuildTmpSrcExternalspocoFoundation_srcFile_WIN32U.cpp
mov r8d, 0x87
lea rcx, str.__path.empty__
call fcn.140221710
cmp qword [rbx + 0x40], 7
lea rcx, [rbx + 0x28]
jbe 0x14022277a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14022278f
not al
and al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140223380
int3

Function at 0x140222740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x140222740
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x14022276c
xor r9d, r9d
lea rdx, str.D:devwinmerge_stableBuildTmpSrcExternalspocoFoundation_srcFile_WIN32U.cpp
mov r8d, 0x87
lea rcx, str.__path.empty__
call fcn.140221710
cmp qword [rbx + 0x40], 7
lea rcx, [rbx + 0x28]
jbe 0x14022277a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14022278f
not al
and al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140223380
int3
Function at 0x140223000
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x14022302c
xor r9d, r9d
lea rdx, str.D:devwinmerge_stableBuildTmpSrcExternalspocoFoundation_srcFile_WIN32U.cpp
mov r8d, 0x192
lea rcx, str.__path.empty__
call fcn.140221710
mov rcx, rbx
call fcn.140223170
test al, al
je 0x14022304c
mov rcx, rbx
call fcn.1402238d0
test al, al
je 0x14022304c
xor al, al
add rsp, 0x20
pop rbx
ret
cmp qword [rbx + 0x40], 7
lea rcx, [rbx + 0x28]
jbe 0x14022305a
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14022306e
mov al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140223380
int3

Function at 0x140223170
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x14022319a
xor r9d, r9d
lea rdx, str.D:devwinmerge_stableBuildTmpSrcExternalspocoFoundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
lea r8d, [r9 + 0x5e]
call fcn.140221710
cmp qword [rbx + 0x40], 7
lea rcx, [rbx + 0x28]
jbe 0x1402231a8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1402231d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
je 0x1402231cd
sub eax, 1
je 0x1402231cd
sub eax, 0xc
je 0x1402231cd
cmp eax, 6
jne 0x1402231dd
xor al, al
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140223380
int3

Function at 0x1402238d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x1402238fc
xor r9d, r9d
lea rdx, str.D:devwinmerge_stableBuildTmpSrcExternalspocoFoundation_srcFile_WIN32U.cpp
mov r8d, LoadRegTypeLib
lea rcx, str.__path.empty__
call fcn.140221710
cmp qword [rbx + 0x40], 7
lea rcx, [rbx + 0x28]
jbe 0x14022390a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140223920
shr eax, 4
and al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140223380
int3

Function at 0x140223930
Capabilities:
Check if file exists

Disassembly:
jmp 0x140223940
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x14022396c
xor r9d, r9d
lea rdx, str.D:devwinmerge_stableBuildTmpSrcExternalspocoFoundation_srcFile_WIN32U.cpp
mov r8d, 0xaa
lea rcx, str.__path.empty__
call fcn.140221710
cmp qword [rbx + 0x40], 7
lea rcx, [rbx + 0x28]
jbe 0x14022397a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140223998
and eax, 0x410
cmp eax, 0x400
sete al
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140223380
int3
Function at 0x140223940
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x140223940
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x14022396c
xor r9d, r9d
lea rdx, str.D:devwinmerge_stableBuildTmpSrcExternalspocoFoundation_srcFile_WIN32U.cpp
mov r8d, 0xaa
lea rcx, str.__path.empty__
call fcn.140221710
cmp qword [rbx + 0x40], 7
lea rcx, [rbx + 0x28]
jbe 0x14022397a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140223998
and eax, 0x410
cmp eax, 0x400
sete al
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140223380
int3

Function at 0x140223c80
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rdi, rcx
jne 0x140223cb0
xor r9d, r9d
lea rdx, str.D:devwinmerge_stableBuildTmpSrcExternalspocoFoundation_srcFile_WIN32U.cpp
mov r8d, 0x16f
lea rcx, str.__path.empty__
call fcn.140221710
mov rcx, rdi
lea rbx, [rdi + 0x28]
call fcn.1402238d0
test al, al
je 0x140223ce2
cmp qword [rbx + 0x18], 7
jbe 0x140223cca
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140223cf9
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp qword [rbx + 0x18], 7
jbe 0x140223cec
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140223cd7
lea rcx, [rdi + 8]
call fcn.140223380
int3