joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004c40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rdi, dword [rcx + 0x3c]
mov rbp, rdx
mov rsi, rcx
mov edx, dword [rdi + rcx + 0x50]
xor ecx, ecx
mov r14, r9
mov r15, r8
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x180004d75
mov r8d, dword [rdi + rsi + 0x54]
mov rdx, rsi
mov rcx, rax
add r8d, dword [rsi + 0x3c]
call sub.msvcrt.dll_memcpy
movsxd rdi, dword [rsi + 0x3c]
mov rdx, rsi
add rdi, rbx
mov rcx, rbx
mov r8, rdi
call fcn.180004680
mov r8, rbx
sub r8, qword [rdi + 0x30]
je 0x180004cc7
mov rdx, rdi
mov rcx, rbx
call fcn.180004710
mov rdx, rdi
mov rcx, rbx
call fcn.1800047c0
test eax, eax
je 0x180004d64
test rbp, rbp
jne 0x180004ce4
test r15, r15
je 0x180004d17
cmp dword [rdi + 0x8c], 0
je 0x180004d64
mov edx, dword [rdi + 0x88]
cmp dword [rdx + rbx + 0x14], 3
jne 0x180004d64
mov eax, dword [rdx + rbx + 0x1c]
mov ecx, dword [rax + rbx + 4]
add rcx, rbx
mov qword [rbp], rcx
mov eax, dword [rdx + rbx + 0x1c]
mov ecx, dword [rax + rbx + 8]
add rcx, rbx
mov qword [r15], rcx
mov esi, dword [rdi + 0x28]
mov rdx, rdi
mov rcx, rbx
call fcn.1800049d0
mov rdx, rdi
mov rcx, rbx
call fcn.180004900
mov r8d, dword [rdi + 0x54]
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
test esi, esi
je 0x180004d98
mov edi, esi
add rdi, rbx
je 0x180004d64
mov edx, 1
mov rcx, rbx
mov r8d, edx
call rdi
test eax, eax
jne 0x180004d90
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rdi
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
test r14, r14
je 0x180004d98
mov qword [r14], rdi
mov rax, rbx
jmp 0x180004d77
Function at 0x180004da0
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x20
mov rdx, rcx
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x40]
xor edi, edi
mov dword [rsp + 0x38], 0x6272
mov qword [rsp + 0x40], rdi
call qword [sym.imp.msvcrt.dll_fopen_s]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180004e7c
lea r8d, [rdi + 2]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rsi
call qword [sym.imp.msvcrt.dll_fseek]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_ftell]
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
xor edx, edx
movsxd rbx, eax
call qword [sym.imp.msvcrt.dll_fseek]
lea r9d, [rdi + 4]
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
mov rsi, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x180004e67
mov r9, qword [rsp + 0x40]
lea edx, [rdi + 1]
mov r8, rsi
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fread]
xor eax, eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov word [rbx], ax
call fcn.180004c40
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_fclose]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140001120
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
jo 0x140001191
invalid
push rax
call fcn.140002b60
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.140020990
nop
lea rcx, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001281
shr eax, 4
not eax
and eax, 1
je 0x140001281
cmp qword [rsi + 0x18], 8
jb 0x1400011e4
mov rcx, qword [rsi]
jmp 0x1400011e7
mov rcx, rsi
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140001219
jmp 0x140001281
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov ecx, eax
call fcn.140033654
mov rbx, rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x44]
mov r8d, edi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rbx
mov rcx, rsi
call fcn.1400012c0
mov edi, eax
mov rcx, rbx
call fcn.140033ccc
nop
cmp qword [rsp + 0x90], 8
jb 0x14000127d
mov rcx, qword [rsp + 0x78]
call fcn.140033ccc
mov eax, edi
jmp 0x140001298
cmp qword [rsp + 0x90], 8
jb 0x140001296
mov rcx, qword [rsp + 0x78]
call fcn.140033ccc
xor eax, eax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140033cf0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400012c0
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, rdx
mov r13, rcx
movsxd rdx, dword [rdx + 0x3c]
movzx eax, word [rdx + rbp + 6]
dec eax
cdqe
lea rcx, [rax + rax*4]
movzx eax, word [rdx + rbp + 0x14]
add rax, rdx
lea rdx, [rax + rcx*8]
lea rax, [rdx + rbp + 0x18]
lea rdi, [0x140062b98]
mov rsi, rax
mov ecx, 7
repe cmpsb byte [rsi], byte [rdi]
je 0x140001331
xor eax, eax
jmp 0x14000148e
mov edi, dword [rax + 0x14]
mov esi, dword [rax + 0x10]
mov ecx, esi
call fcn.140033654
mov rbx, rax
lea rdx, [rbp + rdi]
mov r8d, esi
mov rcx, rax
call fcn.140033fc0
mov r12d, dword [rbx]
lea rbp, [rbx + 4]
xor r14d, r14d
mov ebx, r14d
test r12d, r12d
je 0x140001489
nop word [rax + rax]
mov edx, 0xf
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], r14
mov byte [rsp + 0x38], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rdi, rcx
cmp rcx, 0xfffffffffffffffe
ja 0x14000147c
cmp rcx, rdx
jbe 0x1400013be
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.140002880
mov rdx, qword [rsp + 0x50]
jmp 0x1400013cc
test rcx, rcx
jne 0x1400013cc
mov qword [rsp + 0x48], r14
mov byte [rsp + 0x38], al
test rdi, rdi
setne al
test al, al
je 0x14000140a
lea rcx, [rsp + 0x38]
cmp rdx, 0x10
cmovae rcx, qword [rsp + 0x38]
mov r8, rdi
mov rdx, rbp
call fcn.140033fc0
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rax, qword [rsp + 0x38]
mov byte [rax + rdi], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
add rbp, rcx
mov eax, dword [rbp]
mov dword [rsp + 0x20], eax
add rbp, 4
mov edi, eax
mov ecx, eax
call fcn.140033654
mov rsi, rax
mov r8d, edi
mov rdx, rbp
mov rcx, rax
call fcn.140033fc0
add rbp, rdi
lea rcx, [r13 + 0x28]
lea rdx, [rsp + 0x38]
call fcn.1400015a0
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov qword [rax + 8], rsi
cmp qword [rsp + 0x50], 0x10
jb 0x14000146f
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
inc ebx
cmp ebx, r12d
jb 0x140001370
jmp 0x140001489
lea rcx, str.string_too_long
call fcn.14003356c
int3
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140033cf0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140004e40
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x288], rax
mov edx, 1
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp eax, 0xffffffff
jne 0x140004e7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x140004f96
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140004eae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140004f96
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], rdi
xor esi, esi
lea rcx, [rsp + 0x4c]
call fcn.140034b34
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x278], 7
mov rdx, rax
xor eax, eax
mov qword [rsp + 0x270], rsi
mov rdi, rdx
mov word [rsp + 0x260], si
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x260]
call fcn.140002b60
cmp qword [rsp + 0x278], 8
lea rdx, [rsp + 0x260]
cmovae rdx, qword [rsp + 0x260]
lea rcx, str.iProcManagerX64.exe
call fcn.140035068
test eax, eax
jne 0x140004f4d
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x100400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140004faf
cmp qword [rsp + 0x278], 8
jb 0x140004f65
mov rcx, qword [rsp + 0x260]
call fcn.140033ccc
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140004ec0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140033cf0
add rsp, 0x290
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x278], 8
jb 0x140004fd0
mov rcx, qword [rsp + 0x260]
call fcn.140033ccc
mov rax, rdi
jmp 0x140004f86
Function at 0x1400076b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rdx
mov ebp, 0x20
mov dword [rsp + 0x50], 0x200020
mov dword [rsp + 0x54], 0x200020
mov dword [rsp + 0x58], 0x200020
mov dword [rsp + 0x5c], 0x200020
mov dword [rsp + 0x60], 0x200020
xor esi, esi
mov word [rsp + 0x64], si
mov edx, ecx
lea rcx, [rsp + 0x28]
call fcn.140007380
nop
lea r8, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r8, qword [rsp + 0x28]
lea rdx, str._s
lea rcx, [rsp + 0x50]
call fcn.140005670
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
mov word [rsp + rcx*2 + 0x4e], bp
mov word [rsp + 0x64], si
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140003410
lea r8d, [rbp - 0x1f]
lea rdx, reloc.OLEAUT32.dll_VariantCopy
mov rcx, rbx
call fcn.140003410
nop
cmp qword [rsp + 0x40], 8
jb 0x14000779f
mov rcx, qword [rsp + 0x28]
call fcn.140033ccc
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140033cf0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000a590
Capabilities:
Read file via mapping

Disassembly:
push r12
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
xor edi, edi
mov dword [rsp + 0x30], edi
mov ecx, 0x5000
call fcn.140033654
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14000a5ea
mov r9, rax
lea r8, [0x1400890a0]
lea rdx, [rsp + 0x30]
lea rcx, [0x1400892b8]
call fcn.140012270
mov edi, dword [rsp + 0x30]
jmp 0x14000a5f5
or edx, 0xffffffff
mov rcx, qword [0x1400892c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r12, str.569FBFF4_8578_009F_5D22_45035F533992
mov r8, r12
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rsi, rax
test rax, rax
je 0x14000a650
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
jne 0x14000a67d
mov rcx, rbx
call fcn.140034358
xor al, al
jmp 0x14000a6ca
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14000a671
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call fcn.140033fc0
mov rcx, qword [0x1400892c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call fcn.140034358
mov byte [0x140088f70], 0
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r12
ret

Function at 0x14000a6e0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rcx, qword [0x1400892c8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
lea r8, str.569FBFF4_8578_009F_5D22_45035F533992
lea ecx, [rdx + 4]
xor dil, dil
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor esi, esi
test rax, rax
je 0x14000a755
lea edx, [rsi + 4]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
lea rdx, [0x1400890a0]
mov rcx, rax
mov rbx, rax
call fcn.140010370
mov rcx, rbx
movzx edi, al
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [0x1400892c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx r11d, byte [0x140088f70]
test dil, dil
cmovne r11d, esi
mov rsi, qword [rsp + 0x48]
movzx eax, dil
mov byte [0x140088f70], r11b
add rsp, 0x30
pop rdi
ret
Function at 0x14000d290
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x2a0
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp eax, 0xffffffff
jne 0x14000d2d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
jmp 0x14000d3e0
lea rdx, [rsp + 0x50]
mov rcx, rax
mov dword [rsp + 0x50], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14000d304
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x14000d3e0
mov qword [rsp + 0x2b8], rbp
mov qword [rsp + 0x2c0], rdi
xor ebp, ebp
lea rcx, [rsp + 0x7c]
call fcn.140034b34
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], 7
mov rdx, rax
xor eax, eax
mov qword [rsp + 0x38], rbp
mov rdi, rdx
mov word [rsp + 0x28], bp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x28]
call fcn.140002b60
lea rcx, [rsp + 0x7c]
mov rdx, rsi
call fcn.140035068
test eax, eax
jne 0x14000d39c
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [rsp + 0x58]
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], ebp
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov edx, dword [rsp + 0x24]
cmp dword [rsp + 0x20], edx
je 0x14000d401
test edx, edx
je 0x14000d401
cmp qword [rsp + 0x40], 8
jb 0x14000d3ae
mov rcx, qword [rsp + 0x28]
call fcn.140033ccc
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000d316
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov rbp, qword [rsp + 0x2b8]
mov rdi, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140033cf0
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x2a0
pop rsi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x40], 8
mov edi, dword [rsp + 0x58]
jb 0x14000d420
mov rcx, qword [rsp + 0x28]
call fcn.140033ccc
mov eax, edi
jmp 0x14000d3d0
Function at 0x14000e950
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edi, r9d
mov esi, r8d
mov r13, rdx
mov r12, rcx
mov r9d, r8d
lea r8, [0x140069128]
mov edx, 5
lea rcx, [rsp + 0x50]
call fcn.1400365a8
mov ebp, eax
mov ecx, dword [str.0000]
mov dword [rsp + 0x48], ecx
movzx ecx, byte [0x140069148]
mov byte [rsp + 0x4c], cl
cmp eax, 4
jge 0x14000e9e9
mov ebx, 4
sub ebx, eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp ebx, dword [rsp + 0x30]
jne 0x14000ea4b
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, ebp
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp ebp, dword [rsp + 0x30]
jne 0x14000ea4b
lea rax, vtable.CKeyFileHelper.0
mov qword [rsp + 0x38], rax
dec edi
jne 0x14000ea28
mov edx, esi
mov rcx, r13
call fcn.14000e720
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, esi
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, dword [rsp + 0x30]
je 0x14000ea4f
xor eax, eax
jmp 0x14000ea54
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140033cf0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000ea80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov ebx, r8d
mov rdi, rdx
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x38]
lea r8d, [rax + 4]
mov rsi, rcx
mov qword [rsp + 0x38], rax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x30], 4
je 0x14000eadc
or eax, 0xffffffff
jmp 0x14000eb41
lea r8, [rsp + 0x34]
lea rdx, [0x140069128]
lea rcx, [rsp + 0x38]
mov byte [rsp + 0x3c], 0
call fcn.1400379b8
mov r8d, dword [rsp + 0x34]
lea r9, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x34]
cmp r11d, dword [rsp + 0x30]
jne 0x14000ead7
dec ebx
jne 0x14000eb36
mov edx, r11d
mov rcx, rdi
call fcn.14000e830
mov r11d, dword [rsp + 0x34]
movsxd rax, r11d
mov byte [rax + rdi], 0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140033cf0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140013920
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
lea r8, [rsp + 0x34]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor ebx, ebx
lea r8, [rsp + 0x30]
lea r9d, [rbx + 0x10]
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140033cf0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14001f4e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rbp + 0xf0], rax
xor eax, eax
xor ebx, ebx
mov esi, edx
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x54], eax
lea rax, [0x14001f320]
mov qword [rsp + 0x38], rax
mov eax, dword [0x14007d3a8]
mov rdi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [0x14007d3ac]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x48], eax
mov eax, dword [0x14007d3b0]
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x4c], eax
mov eax, dword [0x14007d3b4]
mov dword [rsp + 0x50], eax
call fcn.14001f610
lea rcx, [rsp + 0x30]
call qword [rax]
test eax, eax
jne 0x14001f5ec
lea rcx, [rsp + 0x64]
xor edx, edx
mov r8d, 0x184
call fcn.140037b90
mov dword [rsp + 0x64], esi
mov dword [rsp + 0x60], 0x188
mov dword [rsp + 0x68], 0x258
mov dword [rsp + 0x6c], 1
call fcn.14001f610
lea edx, [rbx + 3]
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov r8, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
jne 0x14001f5ec
lea rcx, [rdi + 0x14]
lea r8, [0x14001f230]
mov r9, rdi
mov qword [rsp + 0x28], rcx
mov dword [rcx], ebx
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
sete bl
mov eax, ebx
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140033cf0
mov rbx, qword [rsp + 0x230]
add rsp, 0x200
pop rdi
pop rsi
pop rbp
ret
Function at 0x140020f70
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push rbp
lea rbp, [rsp - 0xfb0]
mov eax, 0x10b0
call fcn.140038d50
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x10c8], rbx
mov qword [rsp + 0x10d0], rsi
mov qword [rsp + 0x10d8], rdi
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rbp + 0xfa0], rax
mov rbx, rcx
xor esi, esi
mov word [rbp - 0x60], si
xor edx, edx
mov r8d, 0xffe
lea rcx, [rbp - 0x5e]
call fcn.140037b90
xor r9d, r9d
lea r8d, [rsi + 0x23]
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.140002b60
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002101a
and eax, 0x10
jne 0x140021026
xor edx, edx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
mov r8d, 9
lea rdx, str.piclesoft
lea rcx, [rsp + 0x48]
call fcn.140002b60
nop
lea r8, [rsp + 0x48]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140020d10
nop
mov rdx, rax
mov rcx, rbx
call fcn.1400046b0
nop
cmp qword [rbp - 0x78], 8
jb 0x140021081
mov rcx, qword [rsp + 0x70]
call fcn.140033ccc
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], rsi
mov word [rsp + 0x70], si
cmp qword [rsp + 0x60], 8
jb 0x1400210a4
mov rcx, qword [rsp + 0x48]
call fcn.140033ccc
mov dword [rsp + 0x28], 0x18
mov dword [rsp + 0x38], esi
lea rax, [rsp + 0x28]
test rax, rax
je 0x1400210d3
xor r9d, r9d
lea r8, [rsp + 0x30]
lea edx, [r9 + 1]
lea rcx, str.D:_D_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GRGWGX___AU__A_OICI_GA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
cmp qword [rbx + 0x18], 8
jb 0x1400210df
mov rcx, qword [rbx]
jmp 0x1400210e2
mov rcx, rbx
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp qword [rbx + 0x18], 8
jb 0x1400210f7
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140021111
and eax, 0x10
je 0x140021111
mov eax, 1
jmp 0x140021113
xor eax, eax
mov rcx, qword [rbp + 0xfa0]
xor rcx, rsp
call fcn.140033cf0
lea r11, [rsp + 0x10b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret