joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff6850be4a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x7ff6850be4d6
mov esi, edx
test edx, edx
jne 0x7ff6850be4dd
xor eax, eax
jmp 0x7ff6850be5ca
movsxd rax, dword [rcx + 0x3c]
mov r12, rcx
xor ebx, ebx
add rax, rcx
mov r9d, dword [rax + 0x88]
mov eax, dword [rax + 0x8c]
lea r15, [rcx + r9]
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + 0x18]
mov r14d, dword [r15 + 0x20]
mov ebp, dword [r15 + 0x1c]
mov r13d, dword [r15 + 0x24]
mov dword [rsp + 0x2c], eax
add r14, rcx
cmp dword [rsp + 0x2c], ebx
jbe 0x7ff6850be4d6
mov edi, dword [r14 + rbx*4]
mov r8d, 1
xor edx, edx
add rdi, r12
mov rcx, rdi
call fcn.7ff6850bc3e0
mov r8d, eax
lea rax, [rbx + 1]
cmp r8d, esi
jne 0x7ff6850be5c2
add rbx, rbx
add rbx, r12
movzx eax, word [rbx + r13]
lea rax, [r12 + rax*4]
mov eax, dword [rax + rbp]
add rax, r12
mov qword [rsp + 0x38], rax
cmp rax, r15
jae 0x7ff6850be568
mov rax, qword [rsp + 0x38]
jmp 0x7ff6850be5ca
mov esi, dword [rsp + 0x28]
add rsi, r12
add rsi, r15
cmp rax, rsi
jae 0x7ff6850be561
call fcn.7ff6850c3a40
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], ax
inc eax
mov word [rsp + 0x42], ax
mov rax, qword [0x7ff6850ca170]
mov rax, qword [rax]
mov rax, qword [rax + 0x138]
test rax, rax
je 0x7ff6850be4d6
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, r12
call rax
test eax, eax
jns 0x7ff6850be561
jmp 0x7ff6850be4d6
mov rbx, rax
jmp 0x7ff6850be515
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x7ff6850c2d50
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x7ff6850c2d50
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x7ff6850c2d50
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x7ff6850c2d50
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x7ff6850bbf41
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x7ff6850c2d50
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.7ff6850bc430
cmp eax, 0xa6caa1c5
jne 0x7ff6850bbf2d
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x7ff6850c2d50
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x7ff6850c2d50
mov rcx, r13
inc rsi
call fcn.7ff6850bc430
cmp eax, 0xffe885ef
jne 0x7ff6850bbed1
jmp 0x7ff6850bbefe
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x7ff6850c2d9a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x7ff6850c2d98
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x7ff6850c2d90
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x7ff6850c2d90
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x7ff6850c2d6e
xor eax, eax
ret
Function at 0x7ff668d69600
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov r15, rdx
mov r12, rcx
xor r13d, r13d
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov ebx, 0xf
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x40], r13b
lea rcx, [rbp]
call fcn.7ff668d605c0
mov r14, rax
mov qword [rbp + 0x78], rax
mov byte [rbp - 0x70], r13b
mov qword [rbp - 0x2c], r13
mov dword [rbp - 0x24], 0x67452301
mov dword [rbp - 0x20], 0xefcdab89
mov dword [rbp - 0x1c], 0x98badcfe
mov dword [rbp - 0x18], 0x10325476
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x7ff668d69684
mov rdx, qword [rax]
mov r8d, dword [rax + 0x10]
lea rcx, [rbp - 0x70]
call fcn.7ff668d6f800
lea rcx, [rbp - 0x70]
call fcn.7ff668d6f8e0
cmp byte [rbp - 0x70], 0
jne 0x7ff668d696bb
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rbx
xor r8d, r8d
lea rdx, [0x7ff668db1c2b]
jmp 0x7ff668d69724
lea rbx, [rbp - 0x14]
lea rdi, [rsp + 0x60]
mov esi, 0x10
nop dword [rax]
movzx r8d, byte [rbx]
lea rdx, [0x7ff668db50f8]
mov rcx, rdi
call fcn.7ff668d67280
add rdi, 2
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x7ff668d696d0
mov byte [rbp - 0x80], sil
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x30], r13
mov ebx, 0xf
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x7ff668d69715
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.7ff668d61fd0
nop
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x7ff668d69769
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x7ff668d69764
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff668d69824
mov rcx, r8
call fcn.7ff668d73fb8
mov byte [r14], 0
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], rbx
cmp rbx, 0x10
jb 0x7ff668d697af
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff668d697a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff668d69830
call fcn.7ff668d73fb8
nop
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r12], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [r12 + 0x10], xmm1
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x7ff668d697fa
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x7ff668d697f5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff668d6982a
mov rcx, r8
call fcn.7ff668d73fb8
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], rbx
mov byte [r15], 0
mov rax, r12
mov rbx, qword [rsp + 0x160]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.7ff668d81620
nop
call fcn.7ff668d81620
nop
call fcn.7ff668d81620
int3
Function at 0x7ff668d6fb30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, qword [0x7ff668dcc3d8]
mov ecx, 0x14
mov dword [rbp - 0x40], 0x500014
mov dword [rbp - 0x3c], 0x730076
mov dword [rbp - 0x38], 0x71005c
mov dword [rbp - 0x34], 0x640078
lea r14d, [rcx + 0x26]
mov dword [rbp - 0x30], 0x70003a
mov dword [rbp - 0x2c], 0x780078
mov word [rbp - 0x28], cx
movzx eax, word [0x7ff668db5158]
xor ax, cx
mov word [rbp - 0x26], ax
movzx eax, word [0x7ff668db515a]
xor ax, cx
mov word [rbp - 0x24], ax
movzx eax, word [0x7ff668db515c]
xor ax, cx
mov word [rbp - 0x22], ax
movzx eax, word [0x7ff668db515e]
xor ax, cx
mov word [rbp - 0x20], ax
movzx eax, word [0x7ff668db5160]
xor ax, cx
mov word [rbp - 0x1e], ax
movzx eax, word [0x7ff668db5162]
xor ax, cx
mov word [rbp - 0x1c], ax
movzx eax, word [0x7ff668db5164]
xor ax, cx
mov word [rbp - 0x1a], ax
movzx eax, word [0x7ff668db5166]
xor ax, cx
mov word [rbp - 0x18], ax
movzx eax, word [0x7ff668db5168]
xor ax, cx
mov word [rbp - 0x16], ax
movzx eax, word [0x7ff668db516a]
xor ax, cx
mov word [rbp - 0x14], ax
movzx eax, word [0x7ff668db516c]
xor ax, cx
mov word [rbp - 0x12], ax
xor eax, eax
mov word [rbp - 0x10], ax
xor esi, esi
nop
xor word [rbp + rax*2 - 0x3e], cx
inc rax
cmp rax, 0x17
jae 0x7ff668d6fc44
movzx ecx, word [rbp - 0x40]
jmp 0x7ff668d6fc30
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x3e]
call 0x7ff668f03b4f
int3
Function at 0x7ff668d71210
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x36
syscall
ret

Function at 0x7ff668d74b4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rcx
call 0x7ff668f981f1
test rax, rax
je 0x7ff668d74b97
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x7ff668d74b97
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x7ff668d74b97
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x7ff668d74b97
cmp dword [rcx + 0x84], 0xe
jbe 0x7ff668d74b97
cmp dword [rcx + 0xf8], 0
je 0x7ff668d74b97
mov al, 1
jmp 0x7ff668d74b99
xor al, al
add rsp, 0x28
ret
Function at 0x140001168
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.1400018e4
add rsp, 0x28
jmp 0x140001168
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x14000cb78], rbx
je 0x1400011b2
cmp rax, rbx
jne 0x1400011ca
mov edi, 1
mov eax, dword [0x14000cb80]
cmp eax, 1
jne 0x1400011d7
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x14000124e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000119b
mov eax, dword [0x14000cb80]
test eax, eax
jne 0x140001244
mov dword [0x14000cb80], 1
lea r14, [0x1400096d0]
lea rbx, [0x1400096b8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x140001236
test eax, eax
jne 0x14000123a
cmp qword [rbx], 0
je 0x14000122b
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [0x140009688]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140001202
test eax, eax
je 0x14000124e
mov eax, 0xff
jmp 0x1400013ab
mov dword [0x14000c224], 1
mov eax, dword [0x14000cb80]
cmp eax, 1
jne 0x140001276
lea rdx, [0x1400096b0]
lea rcx, [0x1400096a0]
call sub.msvcrt.dll__initterm
mov dword [0x14000cb80], 2
test edi, edi
jne 0x140001283
xor eax, eax
xchg qword [0x14000cb78], rax
cmp qword [0x14000cb88], 0
je 0x1400012c1
lea rcx, [0x14000cb88]
call fcn.140001850
test eax, eax
je 0x1400012c1
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000cb88]
mov r9, qword [0x140009688]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x14000134d
test cl, cl
je 0x1400012e4
test edi, edi
jne 0x14000134d
dec cl
cmp cl, 0x1f
ja 0x1400012f7
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x1400012e4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140007fe4
mov dword [0x14000c220], eax
cmp dword [0x14000c240], 0
jne 0x140001336
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000c224], 0
jne 0x14000134b
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000c220]
jmp 0x1400013ab
cmp cl, 0x22
jne 0x14000135f
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x140001371
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x1400012d4
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x14000173c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001788
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001780
cmp dword [rcx + 0x3c], edx
jl 0x140001780
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001780
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140001788
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400018b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400018d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400018d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400022f0
Capabilities:
Get file version info

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
xor r15d, r15d
mov r12, r9
mov r14, rdx
mov r13, rcx
mov edi, r15d
mov dword [rbp + 0x58], r15d
mov ebx, r15d
cmp dword [rcx + 0x7c], r15d
jle 0x1400024f2
mov eax, r15d
mov qword [rbp - 0x18], rax
mov esi, dword [r13 + 0x80]
lea r8, [r13 + 0x84]
add rsi, rax
mov rcx, r14
mov eax, dword [rsi + r13 + 0xbc]
add r8, rax
call fcn.140002d34
test eax, eax
je 0x14000250b
lea rdx, [rbp + 0x48]
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
je 0x1400024c2
mov edx, r14d
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140002502
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x1400024f9
mov edx, dword [rbp + 0x48]
mov r8d, r14d
mov r14, qword [rbp + 0x50]
mov r9, rax
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
nop dword [rax + rax]
test eax, eax
je 0x1400024ae
lea r9, [rbp + 0x60]
mov rcx, r15
lea r8, [rbp - 0x10]
lea rdx, [0x14000988c]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
nop dword [rax + rax]
xor r15d, r15d
test eax, eax
je 0x1400024b1
cmp dword [rbp + 0x60], r15d
je 0x1400024b1
mov rax, qword [rbp - 0x10]
lea rcx, [r13 + 0x90]
add rcx, rsi
mov edx, r15d
mov r9d, dword [rax + 0xc]
mov r8d, dword [rax + 8]
cmp r8d, dword [rcx - 0xc]
jae 0x140002434
or eax, 0xffffffff
jmp 0x140002449
jbe 0x14000243d
mov eax, 1
jmp 0x140002449
cmp r9d, dword [rcx - 8]
jb 0x14000242f
mov eax, r15d
seta al
mov dword [rbp + rdx - 0x28], eax
cmp r8d, dword [rcx]
jae 0x140002457
or eax, 0xffffffff
jmp 0x14000246c
jbe 0x140002460
mov eax, 1
jmp 0x14000246c
cmp r9d, dword [rcx + 4]
jb 0x140002452
mov eax, r15d
seta al
mov dword [rbp + rdx - 0x20], eax
add rcx, 0x18
add rdx, 4
cmp rdx, 8
jl 0x140002429
cmp dword [rbp - 0x28], r15d
jl 0x14000248a
cmp dword [rbp - 0x20], r15d
jle 0x1400024b1
cmp dword [rbp - 0x24], r15d
jl 0x140002496
cmp dword [rbp - 0x1c], r15d
jle 0x1400024b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop dword [rax + rax]
mov dword [r12], ebx
mov esi, r15d
jmp 0x140002517
xor r15d, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop dword [rax + rax]
jmp 0x1400024da
cmp dword [rsi + r13 + 0x84], r15d
jne 0x14000250b
cmp dword [rsi + r13 + 0x88], r15d
jne 0x14000250b
mov r14, qword [rbp + 0x50]
mov rax, qword [rbp - 0x18]
inc ebx
add rax, 0x3c
mov qword [rbp - 0x18], rax
cmp ebx, dword [r13 + 0x7c]
jl 0x140002334
mov esi, 1
jmp 0x14000250e
mov esi, dword [rbp + 0x58]
mov dword [r12], ebx
jmp 0x140002517
mov esi, dword [rbp + 0x58]
mov dword [r12], ebx
jmp 0x140002526
mov esi, dword [rbp + 0x58]
mov dword [r12], ebx
test rdi, rdi
je 0x140002526
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, esi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400026b8
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
test rcx, rcx
je 0x1400028ae
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x170], rax
cmp byte [rcx], 0
mov rbx, rcx
je 0x140002888
mov r15d, 0x104
lea rax, [rbp + 0x60]
mov rdi, rbx
lea rcx, [rbp + 0x60]
mov edx, r15d
sub rdi, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002730
mov al, byte [rdi + rcx]
test al, al
je 0x140002730
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140002712
test rdx, rdx
lea rax, [rcx - 1]
lea r8, [0x140009838]
mov rdx, r15
cmovne rax, rcx
lea rcx, [rbp + 0x60]
mov byte [rax], 0
call fcn.1400035a8
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
nop dword [rax + rax]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002888
mov r8, r15
lea rdx, [rbp + 0x60]
lea rcx, [r8 + 0x7ffffefa]
test rcx, rcx
je 0x140002798
mov al, byte [rdi + rdx]
test al, al
je 0x140002798
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x14000277a
test r8, r8
lea rax, [rdx - 1]
cmovne rax, rdx
test byte [rsp + 0x20], 0x10
mov byte [rax], 0
je 0x140002818
lea rdx, [0x14000983c]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
nop dword [rax + rax]
test eax, eax
je 0x14000284e
lea rdx, [0x140009840]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
nop dword [rax + rax]
test eax, eax
je 0x14000284e
lea r8, [rsp + 0x4c]
mov rdx, r15
lea rcx, [rbp + 0x60]
call fcn.1400035a8
lea r8, [0x140009770]
mov edx, r15d
lea rcx, [rbp + 0x60]
call fcn.14000887c
lea rcx, [rbp + 0x60]
call fcn.1400026b8
jmp 0x14000284e
lea r8, [rsp + 0x4c]
mov rdx, r15
lea rcx, [rbp + 0x60]
call fcn.1400035a8
mov edx, 0x80
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop dword [rax + rax]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop dword [rax + rax]
test eax, eax
jne 0x140002773
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400013e0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x140002d34
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor edi, edi
mov rsi, r8
mov byte [rcx], dil
mov rbx, rcx
cmp byte [r8], 0x23
lea r12d, [rdi + 1]
jne 0x140002f3d
add rsi, r12
movsx rcx, byte [rsi]
call qword [sym.imp.USER32.dll_CharUpperA]
nop dword [rax + rax]
mov rcx, rsi
mov r14, rax
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
mov rsi, rax
cmp r14b, 0x41
je 0x140002dee
cmp r14b, 0x53
je 0x140002dd5
cmp r14b, 0x57
jne 0x140002dee
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
jmp 0x140002f37
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
jmp 0x140002f37
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
mov dword [rsp + 0x34], 0x104
lea rax, [rsp + 0x40]
mov edx, 0x104
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002e2d
mov al, byte [r8 + rcx]
test al, al
je 0x140002e2d
mov byte [rcx], al
add rcx, r12
sub rdx, r12
jne 0x140002e0f
test rdx, rdx
lea rax, [rcx - 1]
mov r8, rsi
mov edx, 0x104
cmovne rax, rcx
lea rcx, [rsp + 0x40]
mov byte [rax], dil
call fcn.14000887c
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
jne 0x140002f37
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x140009770]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
jne 0x140002f26
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x140002f1f
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
nop dword [rax + rax]
test eax, eax
je 0x140002f1b
lea r8, [rsp + 0x40]
mov edx, 0x104
sub r8, rbx
mov rcx, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002f08
mov al, byte [r8 + rcx]
test al, al
je 0x140002f08
mov byte [rcx], al
add rcx, r12
sub rdx, r12
jne 0x140002eea
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], dil
mov edi, r12d
jmp 0x140002f26
mov eax, dword [rsp + 0x30]
cmp eax, r12d
cmove edi, r12d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jne 0x140002f5e
jmp 0x140002f4e
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
mov r8, rsi
mov edx, 0x104
mov rcx, rbx
call fcn.14000887c
mov eax, r12d
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400013e0
mov rbx, qword [rsp + 0x198]
add rsp, 0x160
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002f8c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x60
lea rax, [rsp + 0x78]
xor ebx, ebx
mov r9d, 0x20019
mov dword [rsp + 0x70], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSetControlSession_ManagerFileRenameOperations
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
jne 0x140003031
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rbx
xor r9d, r9d
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x48], rbx
xor edx, edx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x70]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, dword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret

Function at 0x140003044
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov edi, 0x104
lea rcx, [rsp + 0x20]
mov edx, edi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
test eax, eax
je 0x1400030eb
lea r8, str.wininit.ini
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.14000887c
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
nop dword [rax + rax]
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll__lopen]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0xffffffff
je 0x1400030eb
xor edx, edx
lea r8d, [rbx + 2]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll__llseek]
nop dword [rax + rax]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll__lclose]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400013e0
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret