joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400456d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov ebp, r9d
mov rdi, r8
mov rsi, rdx
cmp qword [rdx + 0x10], 0
je 0x140045868
test r8, r8
je 0x140045868
lea rcx, [rsp + 0x68]
call fcn.14006d290
nop
mov dword [rsp + 0x20], 3
mov r9d, 1
mov r8d, 0x80000000
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.14006fad0
test al, al
je 0x140045857
xor eax, eax
mov dword [rsp + 0x60], eax
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x140045793
cmp qword [rbx], 0xffffffffffffffff
je 0x140045793
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
mov r8d, ebp
mov rdx, rdi
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140045793
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14004578c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14004578c
mov qword [rbx], 0xffffffffffffffff
mov bl, 1
jmp 0x140045859
mov ecx, 0x800
call fcn.1400bbc88
mov rbp, rax
mov ecx, 0x800
call fcn.1400bbc88
mov rdi, rax
test rbp, rbp
je 0x14004582b
test rax, rax
je 0x140045823
xor edx, edx
mov r8d, 0x800
mov rcx, rbp
call fcn.1400c2130
lea rax, [0x140127af8]
mov qword [rsp + 0x20], rax
lea r9, [0x14012bc60]
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rbp
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call fcn.1400c2130
cmp qword [rsi + 0x18], 8
jb 0x140045808
mov rsi, qword [rsi]
mov r9, rsi
mov r8, rbp
mov edx, 0x400
mov rcx, rdi
call fcn.140007140
mov rcx, rdi
call fcn.140015100
mov rcx, rbp
call fcn.1400bd2dc
test rdi, rdi
je 0x140045838
mov rcx, rdi
call fcn.1400bd2dc
test rbx, rbx
je 0x140045857
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140045857
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140045857
mov qword [rbx], 0xffffffffffffffff
xor bl, bl
lea rcx, [rsp + 0x68]
call fcn.14006fa80
movzx eax, bl
jmp 0x14004586a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140048180
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rdx
mov rbx, r8
sub rdi, rcx
mov rsi, rcx
mov ebp, r15d
add rdi, 7
shr rdi, 3
cmp rcx, rdx
cmova rdi, r15
test rdi, rdi
je 0x1400482ce
mov qword [rsp + 0x50], r14
mov r14, qword [rsi]
mov eax, dword [r14]
mov ecx, eax
shr eax, 1
shr ecx, 7
and eax, 0x3f
and ecx, 0x3f
add ecx, eax
mov rax, qword [rbx]
lea ecx, [rcx*2 + 8]
mov dword [rax], ecx
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov ecx, dword [rdx + 0xc]
add ecx, dword [rax]
cmp ecx, 0x3f0
jle 0x140048260
mov rax, qword [rbx + 0x10]
mov ecx, dword [rax]
mov dword [rdx + 4], ecx
mov rax, qword [rbx + 0x18]
mov rdx, qword [rbx + 8]
mov rcx, qword [rax]
test rcx, rcx
je 0x140048232
test rdx, rdx
je 0x140048232
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x140048232
mov r9, qword [rbx + 0x20]
mov r8d, 0x400
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbx + 8]
xor edx, edx
mov r8d, 0x400
call fcn.1400c2130
mov rax, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [rbx + 8]
mov dword [rax + 4], 0xffffffff
mov rax, qword [rbx + 0x10]
inc dword [rax]
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov rdx, r14
movsxd r8, dword [rax]
movsxd rax, dword [rcx + 0xc]
add rcx, 0x10
add rcx, rax
call fcn.1400bcb10
mov ecx, dword [r14]
shr ecx, 7
and ecx, 0x3f
cmp ecx, 0x20
jl 0x140048295
mov rax, qword [rbx + 8]
or dword [rax + 8], 1
jmp 0x1400482a3
mov rdx, qword [rbx + 8]
mov eax, 1
shl eax, cl
or dword [rdx + 8], eax
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
inc rbp
mov ecx, dword [rax]
add rsi, 8
add dword [rdx + 0xc], ecx
mov rax, qword [rbx + 0x28]
mov rcx, qword [rax]
inc dword [rcx + 0x44]
cmp rbp, rdi
jne 0x1400481c1
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x1400490c0
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, r8
mov rdi, rdx
mov rcx, rdx
call fcn.1400638d0
test eax, eax
jne 0x1400490f2
xor al, al
jmp 0x1400491a3
cmp eax, 0x130d4c
jne 0x1400490eb
mov ecx, eax
call fcn.1400bbc88
mov rbx, rax
test rax, rax
je 0x1400490eb
lea rcx, [rsp + 0x30]
call fcn.14006d290
nop
mov dword [rsp + 0x20], 3
mov r9d, 1
mov r8d, 0x80000000
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14006fad0
test al, al
je 0x14004918a
xor eax, eax
mov dword [rsp + 0x68], eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14004918a
cmp qword [rcx], 0xffffffffffffffff
je 0x14004918a
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
mov r8d, 0x130d4c
mov rdx, rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004918a
mov rdx, rsi
mov rcx, rbx
call fcn.140056d60
movzx edi, al
mov rcx, rbx
call fcn.1400bd2dc
jmp 0x140049195
mov rcx, rbx
call fcn.1400bd2dc
xor dil, dil
lea rcx, [rsp + 0x30]
call fcn.14006fa80
movzx eax, dil
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140049f20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0x10]
lea r14, [rcx + 0x10]
mov rdi, rdx
dec eax
mov rbx, rcx
cmp eax, 0x3f
ja 0x14004a17d
mov rcx, qword [rcx]
test rcx, rcx
je 0x14004a17d
lea rdx, [0x1400f50d8]
mov r8d, 1
call fcn.1400bef30
test eax, eax
je 0x14004a17d
mov rax, qword [rdi]
mov qword [rsp + 0x58], rbp
xor ebp, ebp
mov dword [rsp + 0x60], ebp
test rax, rax
je 0x14004a16d
test r14, r14
je 0x14004a16d
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x14004a16d
lea r9, [rsp + 0x60]
lea r8d, [rbp + 4]
mov rdx, r14
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004a16d
cmp dword [rsp + 0x60], 4
jne 0x14004a16d
mov rax, qword [rdi]
mov rdx, qword [rbx]
mov qword [rsp + 0x68], rsi
mov esi, dword [r14]
add esi, esi
test rax, rax
je 0x14004a169
test rdx, rdx
je 0x14004a169
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x14004a169
lea r9, [rsp + 0x60]
mov r8d, esi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004a169
cmp esi, dword [rsp + 0x60]
jne 0x14004a169
mov rax, qword [rbx + 8]
test rax, rax
je 0x14004a039
movzx ecx, word [rax]
test cl, 0x1f
jne 0x14004a032
mov eax, 0x7e0
test ax, cx
mov eax, 1
je 0x14004a034
mov eax, ebp
test al, al
sete al
test al, al
mov rax, qword [rdi]
setne byte [rsp + 0x50]
test rax, rax
je 0x14004a169
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x14004a169
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov r8d, 1
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004a169
cmp dword [rsp + 0x60], 1
jne 0x14004a169
cmp byte [rsp + 0x50], bpl
je 0x14004a0de
mov esi, dword [r14]
mov rax, qword [rdi]
mov rdx, qword [rbx + 8]
add esi, esi
test rax, rax
je 0x14004a169
test rdx, rdx
je 0x14004a169
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x14004a169
lea r9, [rsp + 0x60]
mov r8d, esi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004a169
cmp esi, dword [rsp + 0x60]
jne 0x14004a169
mov rax, qword [rdi]
lea rdx, [rbx + 0x14]
test rax, rax
je 0x14004a169
test rdx, rdx
je 0x14004a169
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x14004a169
lea r9, [rsp + 0x60]
mov r8d, 4
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004a169
cmp dword [rsp + 0x60], 4
jne 0x14004a169
mov rax, qword [rdi]
lea rdx, [rbx + 0x18]
test rax, rax
je 0x14004a169
test rdx, rdx
je 0x14004a169
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x14004a169
lea r9, [rsp + 0x60]
mov r8d, 8
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004a169
cmp dword [rsp + 0x60], 8
jne 0x14004a169
mov al, 1
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret
xor al, al
jmp 0x14004a156
xor al, al
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret
xor al, al
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret
Function at 0x140060c50
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov ebx, edx
mov r11, rcx
test rcx, rcx
je 0x140060cac
test r8, r8
je 0x140060cac
test r9, r9
je 0x140060cac
xor r10d, r10d
test edx, edx
jle 0x140060ca8
mov qword [rsp + 0x10], rdi
mov edi, dword [rsp + 0x30]
sub r11, r8
nop dword [rax]
mov eax, r10d
inc r10d
lea r8, [r8 + 1]
cdq
idiv edi
movsxd rax, edx
movzx ecx, byte [rax + r9]
xor cl, byte [r11 + r8 - 1]
mov byte [r8 - 1], cl
cmp r10d, ebx
jl 0x140060c80
mov rdi, qword [rsp + 0x10]
mov al, 1
pop rbx
ret
xor al, al
pop rbx
ret

Function at 0x140060cb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov r10, r8
mov edi, edx
mov rbx, rcx
test rcx, rcx
je 0x140060d1c
test r8, r8
je 0x140060d1c
test r9, r9
je 0x140060d1c
xor r11d, r11d
test edx, edx
jle 0x140060d13
mov qword [rsp + 0x10], rsi
mov esi, dword [rsp + 0x30]
sub rbx, r8
movzx r8d, byte [rbx + r10]
mov eax, r11d
inc r11d
cdq
rol r8b, 3
lea r10, [r10 + 1]
mov byte [r10 - 1], r8b
idiv esi
movsxd rax, edx
movzx ecx, byte [rax + r9]
xor cl, r8b
mov byte [r10 - 1], cl
cmp r11d, edi
jl 0x140060ce0
mov rsi, qword [rsp + 0x10]
mov al, 1
mov rbx, qword [rsp + 0x18]
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x18]
pop rdi
ret
Function at 0x140064ae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor dil, dil
mov byte [rsp + 0x30], dil
xor r12d, r12d
mov word [rsp + 0x40], r12w
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x42]
call fcn.1400c2130
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140064820
cmp byte [rsi + 0x40], dil
je 0x140064b73
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140064b6f
test al, 0x10
jne 0x140064b6f
call fcn.1400690b0
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140069180
test al, al
jne 0x140064b73
xor al, al
jmp 0x140064be8
mov qword [rsi + 0x48], r12
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140064be8
lea rdx, str.ExtractArchive
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140064bc9
mov qword [rsi + 0x48], rbx
mov qword [rsp + 0x20], rsi
lea r9, [0x140064750]
lea r8, [0x1400f50d8]
mov rdx, r15
mov rcx, r14
call rax
test eax, eax
sete dil
mov byte [rsp + 0x30], dil
mov qword [rsi + 0x48], r12
jmp 0x140064bd6
test rbx, rbx
je 0x140064be4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, dil
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x470
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140064c60
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x140064c9e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
xor eax, eax
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.140077cc0
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x140064cc6
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x140064cd9
cmp qword [rsi + 0x18], 8
jb 0x140064cdc
mov rsi, qword [rsi]
jmp 0x140064cdc
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x140064d00
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140064d00
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x140064d27
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140064d3a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov rcx, rbx
call fcn.1400bd20c
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140064d70
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x140064dae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
xor eax, eax
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.140077db0
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x140064dd6
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x140064de9
cmp qword [rsi + 0x18], 8
jb 0x140064dec
mov rsi, qword [rsi]
jmp 0x140064dec
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x140064e18
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140064e10
mov byte [rdi + 9], 1
mov rcx, qword [rdi]
call fcn.140066900
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x140064e3f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140064e52
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov rcx, rbx
call fcn.1400bd20c
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140065820
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rdx
mov r14d, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], rdx
xor ebx, ebx
mov qword [rdx + 0x10], rbx
cmp qword [rdx + 0x18], 8
jb 0x140065863
mov rax, qword [rdx]
jmp 0x140065866
mov rax, rdx
mov word [rax], bx
call fcn.140065950
movzx esi, al
mov byte [rsp + 0x20], al
jmp 0x14006588b
test sil, sil
jne 0x14006591f
cmp r14d, 0x1a
jne 0x14006591f
mov qword [rdi + 0x10], rbx
cmp qword [rdi + 0x18], 8
jb 0x1400658ae
mov rax, qword [rdi]
jmp 0x1400658b1
mov rax, rdi
mov word [rax], bx
mov word [rsp + 0x40], bx
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x42]
call fcn.1400c2130
mov r8d, 0x207
lea rdx, [rsp + 0x40]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [rsp + 0x40], 0
je 0x1400658fe
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400658f4
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140006900
movzx esi, sil
mov eax, 1
cmp qword [rdi + 0x10], 0
cmovne esi, eax
movzx eax, sil
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r14
pop rdi
pop rsi
ret

Function at 0x140065bf0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.1400bd270
lea rcx, [rsp + 0x20]
xor edx, edx
mov qword [rbx], rax
mov r8d, 0x11c
mov byte [rax], 0
call fcn.1400c2130
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x140065c57
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400bcae0
add rsp, 0x150
pop rbx
ret
Function at 0x1400685a0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8d, 0x11c
mov rbx, rcx
call fcn.1400c2130
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14006860c
mov eax, dword [rbx + 4]
cmp eax, 6
ja 0x1400685d9
jne 0x140068604
cmp dword [rbx + 8], 2
jb 0x140068604
xor eax, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x38], eax
call fcn.140068550
test al, al
je 0x140068604
mov eax, dword [rsp + 0x30]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x38]
mov dword [rbx + 8], eax
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14006d870
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rdx, qword [rcx + 0x10]
test rdx, rdx
jne 0x14006d8a1
xor al, al
jmp 0x14006d968
xor eax, eax
mov qword [rsp + 0x38], rax
add rdx, 0x38
lea rcx, [rsp + 0x38]
call fcn.140015bf0
nop
mov rax, qword [rbx + 0x10]
cmp qword [rax + 8], 0
je 0x14006d959
mov eax, 1
lock xadd dword [rbx + 8], eax
mov rcx, qword [rbx + 0x10]
add rcx, 0x14
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x14006d550]
xor edx, edx
xor ecx, ecx
call fcn.1400be488
mov rcx, qword [rbx + 0x10]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x10]
cmp qword [rax + 0x18], 0
jne 0x14006d92b
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x14006d920
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rbx + 0x10]
call fcn.14006d6c0
jmp 0x14006d959
mov byte [rax + 0x10], 1
mov rax, qword [rbx + 0x10]
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x14006d942
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14006d90b
mov bl, 1
jmp 0x14006d95b
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.140015c20
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bcae0
add rsp, 0x50
pop rbx
ret
Function at 0x1400703e0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x30], 0
test rcx, rcx
je 0x140070453
test rdx, rdx
je 0x140070453
cmp qword [rcx], 0xffffffffffffffff
je 0x140070453
mov dword [rsp + 0x30], 0
mov rcx, qword [rcx]
lea r9, [rsp + 0x30]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140070453
cmp dword [rsp + 0x30], 1
jne 0x140070453
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400bcae0
add rsp, 0x48
ret
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400bcae0
add rsp, 0x48
ret
Function at 0x1400789a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x20a
mov word [rsp + 0x20], bx
call fcn.1400c2130
lea rcx, [rsp + 0x20]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x140078a2e
mov word [rsp + 0x22a], bx
cmp word [rsp + 0x20], bx
je 0x140078a1a
lea rax, [rsp + 0x20]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140078a10
lea rdx, [rsp + 0x20]
mov r8, rbx
mov rcx, rdi
call fcn.140006900
mov al, 1
jmp 0x140078a30
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret

Function at 0x140078a60
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, edx
mov rbx, rcx
and edi, 0xffffb1af
cmp qword [rcx + 0x18], 8
jb 0x140078a9d
mov rcx, qword [rcx]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140078aad
mov al, 1
jmp 0x140078b28
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140079ce0
test al, al
je 0x140078afe
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140078afe
mov bl, 1
jmp 0x140078b00
xor bl, bl
cmp qword [rsp + 0x40], 8
jb 0x140078b12
mov rcx, qword [rsp + 0x28]
call fcn.1400bd20c
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140078b50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x140078b85
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140078c02
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140079ce0
test al, al
je 0x140078bdb
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp qword [rsp + 0x40], 8
jb 0x140078bed
mov rcx, qword [rsp + 0x28]
call fcn.1400bd20c
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret