joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140116f98
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
xor edi, edi
mov rax, r15
lea rcx, [0x1401df540]
and eax, 0x3f
mov r12, r15
sar r12, 6
mov rsi, rdx
lea r9d, [rdi + 0xa]
mov r14, r15
lea rbp, [rax + rax*8]
mov rax, qword [rcx + r12*8]
mov r10, qword [rax + rbp*8 + 0x28]
test r8, r8
je 0x140116fee
cmp word [rdx], r9w
jne 0x140116fee
or byte [rax + rbp*8 + 0x38], 4
jmp 0x140116ff3
and byte [rax + rbp*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rax, rsi
mov rbx, rsi
cmp rsi, r8
jae 0x140117172
mov r11d, reloc.WS2_32.dll_listen
lea r13d, [r11 - 0xb]
movzx edx, word [rax]
cmp dx, 0x1a
je 0x14011713d
lea rcx, [rax + 2]
cmp dx, r11w
jne 0x14011703b
cmp rcx, r8
jae 0x14011705b
cmp word [rcx], r9w
jne 0x14011703b
add rax, 4
mov edx, r9d
jmp 0x14011703e
mov rax, rcx
mov word [rbx], dx
mov r9, r13
mov rcx, rbx
mov r9d, 0xa
lea rbx, [rbx + r13]
cmp rax, r8
jb 0x140117010
jmp 0x140117172
lea r9, [rsp + 0x80]
mov word [rsp + 0x70], di
mov r8d, r13d
mov dword [rsp + 0x80], edi
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdi
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140117136
cmp dword [rsp + 0x80], edi
je 0x140117136
lea r9, [0x1401df540]
mov rax, qword [r9 + r12*8]
test byte [rax + rbp*8 + 0x38], 0x48
mov ebp, 0xa
je 0x140117110
movzx eax, word [rsp + 0x70]
cmp ax, bp
jne 0x1401170c3
mov word [rbx], bp
jmp 0x14011716f
mov word [rsp + 0x78], ax
mov rdx, r14
mov rax, r14
sar rdx, 6
and eax, 0x3f
mov word [rbx], reloc.WS2_32.dll_listen
lea r8, [rax + rax*8]
mov rax, qword [r9 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, r13
jl 0x1401170de
mov rax, r14
sar rax, 6
and r14d, 0x3f
mov rax, qword [r9 + rax*8]
lea rcx, [r14 + r14*8]
mov byte [rax + rcx*8 + 0x3c], bpl
jmp 0x14011716f
cmp word [rsp + 0x70], bp
jne 0x14011711c
cmp rbx, rsi
je 0x1401170bb
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1401154bc
cmp word [rsp + 0x70], bp
je 0x140117172
mov word [rbx], reloc.WS2_32.dll_listen
jmp 0x14011716f
mov rcx, r15
lea r9, [0x1401df540]
and ecx, 0x3f
mov rax, r15
sar rax, 6
lea r8, [rcx + rcx*8]
mov rcx, qword [r9 + rax*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x14011716c
or al, r13b
mov byte [rcx + r8*8 + 0x38], al
jmp 0x140117172
mov word [rbx], dx
add rbx, r13
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14011c534
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14011c54a
mov al, 1
jmp 0x14011c5b6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14011c55b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14011c5b4
mov ecx, dword [rcx + 0x18]
nop
call fcn.14011d9bc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14011c5b4
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14011c5b4
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14011c5b4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14011c5b6
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14011dacc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1401154bc
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1401154bc
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14011dc19
cmp rax, 0xffffffffffffffff
je 0x14011dc19
xor edi, edi
test rbp, rbp
jle 0x14011dbc7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140119aa0
mov rbx, rax
test rax, rax
jne 0x14011db54
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14011dbbd
mov edx, 0x8000
mov ecx, r14d
call fcn.140116bec
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140118428
cmp eax, 0xffffffff
je 0x14011db9d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14011db64
mov edx, r15d
mov ecx, r14d
call fcn.140116bec
jmp 0x14011dbbd
cmp byte [rsi + 0x38], dil
je 0x14011dbb4
cmp dword [rsi + 0x34], 5
jne 0x14011dbb4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x14011dbbd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140119b20
jmp 0x14011dc2b
jns 0x14011dc2b
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1401154bc
cmp rax, 0xffffffffffffffff
jne 0x14011dbe5
cmp byte [rsi + 0x30], dil
je 0x14011dc2b
jmp 0x14011dc21
mov ecx, r14d
call fcn.14011d9bc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14011dc2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x14011dc2b
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14011dc26
mov edi, dword [rsi + 0x2c]
jmp 0x14011dc2b
mov edi, socket
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1401154bc
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140120d60
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140120de7
mov rsi, rbx
cmp word [rax], bp
je 0x140120da6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140120d90
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140120d8c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14011a7c0
mov rdi, rax
test rax, rax
je 0x140120dd4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1401282a0
mov rbp, rdi
xor ecx, ecx
call fcn.140119b20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401220bc
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401220dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140111e5c
or eax, 0xffffffff
jmp 0x1401220de
xor eax, eax
add rsp, 0x28
ret

Function at 0x140124038
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1401dd7c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x140124082
call fcn.140111ea8
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.140111ecc
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.1401103e4
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400fcd60
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x14012408d
lea eax, [rbx + 1]
jmp 0x14012406f
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x14012406d
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x14012406f

Function at 0x1401266f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140126718
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140126718
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400010b8
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.140001066
mov rcx, rdi
mov edx, 1
call fcn.140001421
mov qword [rsi + 0x30], rax
mov rcx, rdi
mov edx, 0x1f
call fcn.140001421
mov qword [rsi + 0x20], rax
lea rdi, [rsp + 0x34]
mov dword [rdi], 0
mov qword [rsp + 0x20], 2
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallMicrosoft_Edge
lea r8, str.ChromeInstallerCleanup
mov rcx, 0xffffffff80000001
mov r9, rdi
call fcn.140003dd6
cmp word [rdi], 0x30
setne cl
xor al, 1
or al, cl
mov byte [rsi + 0x28], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rsi
mov rdx, rax
call fcn.140001164
mov ebx, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400049e0
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140001421
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
movzx edx, dx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140001493
mov rbx, rax
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140001493
mov rdi, rax
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
xor eax, eax
test esi, esi
je 0x140001495
mov ecx, esi
and ecx, 1
jne 0x140001495
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140001493
mov rcx, rax
and esi, 0xfffffffe
xor eax, eax
cmp word [rcx + rsi - 2], 0
cmove rax, rcx
jmp 0x140001495
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140001bf4
Capabilities:
Self delete using alternate data streams

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov dword [rdx], 1
mov r15, qword [sym.imp.KERNEL32.dll_CreateFileW]
xorps xmm6, xmm6
lea rbx, [rsp + 0x40]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x10000
mov r8d, 7
xor r9d, r9d
call r15
cmp rax, 0xffffffffffffffff
je 0x140001c9b
mov r14, rax
mov byte [rsp + 0x40], 1
mov rcx, rax
mov edx, 4
mov r8, rbx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x140001ca6
mov rcx, r14
call r13
jmp 0x140001c3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x140001cb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov rcx, r14
call r13
mov ebp, r12d
and ebp, 0xfffffffe
cmp ebp, 2
je 0x140001db6
cmp r12d, 0x91
je 0x140001d4c
cmp r12d, 0x20
je 0x140001d4c
cmp r12d, 5
jne 0x140001db6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x180
mov r8d, 7
xor r9d, r9d
call r15
cmp rax, 0xffffffffffffffff
je 0x140001d4c
mov r14, rax
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x60], 0
mov rcx, rax
xor edx, edx
mov r8, rbx
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x140001d46
mov eax, dword [rsp + 0x60]
test al, 1
jne 0x140001d87
mov rcx, r14
call r13
mov eax, dword [rsi]
cmp eax, 0x96
je 0x140001db6
inc eax
mov dword [rsi], eax
mov rax, qword [0x140007098]
test rax, rax
je 0x140001d77
mov rcx, qword [0x1400070a0]
call qword [0x140009008]
jmp 0x140001c3d
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001c3d
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov r12d, eax
mov rcx, r14
call r13
test r12d, r12d
jne 0x140001c3d
jmp 0x140001d4c
cmp ebp, 2
sete bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400049e0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400024ee
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov edi, r9d
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0xf0], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x80]
movaps xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x60], rcx
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x10], xmm0
mov dword [rax], 0x68
lea rdx, [rsp + 0x60]
mov qword [rdx + 0x10], rcx
movaps xmmword [rdx], xmm0
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r8
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400025b7
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5c], 0
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400025e0
mov edi, 0x6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140002605
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp ebp, 3
je 0x140002629
cmp ebp, 2
je 0x140002605
mov eax, dword [rsp + 0x148]
mov dword [rsi], eax
mov dword [rsi + 4], ebp
jmp 0x14000260a
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400025aa
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, dword [rsp + 0x5c]
mov dword [rsi], edi
mov dword [rsi + 4], eax
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400049e0
mov rax, rsi
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov ecx, dword [rsp + 0x140]
mov dword [rsi], ecx
jmp 0x140002607

Function at 0x140003060
Capabilities:
Get disk information

Disassembly:
push rsi
sub rsp, 0x260
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x258], rax
xor esi, esi
lea rdx, [rsp + 0x4e]
mov word [rdx + 0x208], si
mov word [rdx], si
mov dword [rsp + 0x48], 0
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x1400030e5
xor esi, esi
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x4e]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1400030e5
mov sil, byte [rsp + 0x48]
and sil, 8
shr sil, 3
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.1400049e0
mov eax, esi
add rsp, 0x260
pop rsi
ret
Function at 0x14000332a
Capabilities:
Create directory
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, r8
mov rdi, rdx
mov r15, rcx
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [r8], 0x6c
mov edx, 0x104
mov rcx, rdi
mov r8, r15
call fcn.140003989
test al, al
je 0x140003472
lea r8, str.EDGEMITMP_
mov ebx, 0x104
mov edx, 0x104
mov rcx, rdi
call fcn.1400039ba
test al, al
je 0x140003472
mov edx, 0x104
mov rcx, rdi
call fcn.140003964
sub rbx, rax
cmp rbx, 0xb
jb 0x140003472
mov r14, rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x38]
movaps xmmword [rdx - 8], xmm0
mov qword [rdx + 8], 0
mov dword [rdx - 8], 0x18
mov rcx, r15
call fcn.1400031f8
test al, al
je 0x140003461
mov qword [rsi], 0x6d
lea r15, [rdi + r14*2]
mov rbp, r14
add rbp, 5
mov r13d, 0xfffffff6
lea r12, [rsp + 0x2c]
mov rcx, r12
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
mov edx, 4
mov rcx, r12
mov r8, r15
mov r9, rbx
call fcn.140003910
cmp rbp, 0x103
ja 0x140003428
mov word [rdi + r14*2 + 0xa], 0
mov edx, 0x104
mov rcx, rdi
lea r8, str..tmp
call fcn.1400039ba
mov rdx, qword [rsp + 0x38]
test rdx, rdx
lea rax, [rsp + 0x30]
cmovne rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140003494
inc r13d
jne 0x1400033f7
jmp 0x1400034af
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 0x75
mov qword [rsi], rax
xor esi, esi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400049e0
mov eax, esi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x140005778]
mov edx, 0x104
mov rcx, rdi
call fcn.1400039ba
mov qword [rsi], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400034bf
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [rsi], 0
sete sil
jmp 0x140003474

Function at 0x140003c24
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea eax, [rdi + rdi]
lea r8, [rsp + 0x30]
mov dword [r8], eax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140003cac
mov ebx, 0x32
cmp dword [rsp + 0x34], 1
jne 0x140003cac
mov eax, dword [rsp + 0x30]
cmp rax, 2
jb 0x140003ca5
mov ecx, eax
and ecx, 0xfffffffe
cmp word [rsi + rcx - 2], 0
je 0x140003caa
shr eax, 1
mov ebx, 0xea
cmp rax, rdi
jae 0x140003cac
add rsi, rcx
mov word [rsi], 0
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400049e0
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140003cc4
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea rax, [rsp + 0x30]
mov dword [rax], 4
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x140003d26
mov esi, 0x32
cmp dword [rsp + 0x34], 4
jne 0x140003d26
xor eax, eax
cmp dword [rsp + 0x30], 4
mov esi, 0xe8
cmove esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400049e0
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x140003d3c
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140003d84
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400049e0
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x140003f00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rbx, [rsp + 0x38]
mov rcx, rbx
call fcn.140001ecc
mov rcx, rbx
mov rdx, rsi
call fcn.140001f1a
test al, al
je 0x140003fe5
mov rbx, qword [rdi + 8]
mov sil, 1
test rbx, rbx
je 0x140003fe7
xor r13d, r13d
mov ebp, 0x800000
lea r14, [rsp + 0x38]
lea r15, [rsp + 0x34]
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFile]
sub rbx, r13
cmp rbx, rbp
cmovae rbx, rbp
mov dword [rsp + 0x34], 0
mov r12, qword [rdi]
add r12, r13
mov rcx, r14
call fcn.1400020b2
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r12
mov r8d, ebx
mov r9, r15
call rsi
test eax, eax
je 0x140003fc0
add r13, rbx
mov rbx, qword [rdi + 8]
cmp r13, rbx
jb 0x140003f74
mov sil, 1
jmp 0x140003fe7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.140001fba
mov rcx, rdi
call fcn.140001ee8
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea rcx, [rsp + 0x38]
call fcn.140001ee8
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400049e0
mov eax, esi
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140004018
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x298
mov rbx, r8
mov rsi, rcx
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov dword [rsp + 0x24], r9d
xor edi, edi
lea r14, [rsp + 0x25e]
mov word [r14 + 0x30], di
mov word [r14], di
lea rax, str.msedgewebview2setup.exe
lea r8, str.setup.exe
test dl, dl
cmovne r8, rax
mov edx, 0x18
mov rcx, r14
call fcn.140003989
mov rcx, qword [rsi]
lea r8, str.ApplicationName
xor edx, edx
mov r9, r14
call sub.wer.dll_WerReportSetParameter
test eax, eax
js 0x1400041d3
mov rcx, qword [rsi]
lea r8, str.ApplicationVersion
mov edx, 1
mov r9, rbx
call sub.wer.dll_WerReportSetParameter
test eax, eax
js 0x1400041d1
mov rcx, qword [rsi]
lea r8, str.Source
lea r9, str.EdgeInstallerError
mov edx, 2
call sub.wer.dll_WerReportSetParameter
test eax, eax
js 0x1400041d1
xor edi, edi
lea rbx, [rsp + 0x234]
mov word [rbx + 0x28], di
mov word [rbx], di
mov r14d, 0x14
mov edx, 0x14
mov rcx, rbx
call fcn.140003964
sub r14, rax
mov edx, 0x14
mov rcx, rbx
call fcn.140003964
lea r8, [rsp + rax*2]
add r8, 0x234
lea rcx, [rsp + 0x24]
mov edx, 4
mov r9, r14
call fcn.140003910
mov rcx, qword [rsi]
lea r8, str.ExitCode
mov edx, 3
mov r9, rbx
call sub.wer.dll_WerReportSetParameter
test eax, eax
js 0x1400041d3
xor edi, edi
lea rdx, [rsp + 0x2a]
mov word [rdx + 0x208], di
mov word [rdx], di
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xfffffefc
cmp eax, 0xfffffefd
jb 0x1400041d3
lea r8, str.msedge_installer.log
lea rcx, [rsp + 0x2a]
mov edx, 0x104
call fcn.1400039ba
test al, al
je 0x1400041d1
lea rcx, [rsp + 0x2a]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400041d1
mov rcx, qword [rsi]
lea rdx, [rsp + 0x2a]
xor edi, edi
mov r8d, 5
xor r9d, r9d
call sub.wer.dll_WerReportAddFile
test eax, eax
js 0x1400041d3
mov rcx, qword [rsi]
lea r9, [rsp + 0x20]
mov edx, 1
mov r8d, 0x20
call sub.wer.dll_WerReportSubmit
test eax, eax
setns dil
jmp 0x1400041d3
xor edi, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400049e0
mov eax, edi
add rsp, 0x298
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400043e4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x14000445c
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x14000445c
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x14000445c
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140004450
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x14000446e
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14000443e
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14000445e