joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140088d40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x1c0
mov rax, qword [0x1400c9030]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x140088d70
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140088e7a
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140088d8c
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14004afe0
mov rbx, rax
mov dword [rsp + 0x30], 2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x75
lea r8, str.T:p4depotLoL__MAIN__codeExternal_sentry_tmp_sentry_nativeexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.140049da0
nop
mov dword [rsp + 0x30], 6
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1400012e0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140088e17
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140001da0
nop
lea rcx, [rsp + 0x50]
call fcn.14004a080
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x140088f14
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140088e70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140088f2f
call fcn.1400532f4
jmp 0x140088f14
test eax, 0x410
jne 0x140088f14
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140088e92
mov rcx, qword [rbx]
lea rdx, [rsp + 0x178]
call fcn.14008ab88
test eax, eax
jne 0x140088ead
mov rax, qword [rsp + 0x190]
jmp 0x140088f16
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0xac
lea r8, str.T:p4depotLoL__MAIN__codeExternal_sentry_tmp_sentry_nativeexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.unsigned___int64___cdecl_crashpad::GetFileSize_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.140049da0
nop
mov dword [rsp + 0x30], 1
lea rdx, str.stat
mov rcx, rax
call fcn.1400012e0
cmp qword [rbx + 0x18], 8
jb 0x140088efe
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1400039b0
nop
lea rcx, [rsp + 0x50]
call fcn.14004a080
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400536a0
add rsp, 0x1c0
pop rbx
ret
call fcn.140059ac4
int3
Function at 0x140088f40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1400c9030]
xor rax, rsp
mov qword [rsp + 0x178], rax
movzx edi, dl
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x140088f77
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140089078
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140088f93
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14004afe0
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x82
lea r8, str.T:p4depotLoL__MAIN__codeExternal_sentry_tmp_sentry_nativeexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::IsDirectory_const_class_base::FilePath__bool_
lea rcx, [rsp + 0x50]
call fcn.140049da0
nop
mov dword [rsp + 0x30], 3
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1400012e0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14008901e
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140001da0
nop
lea rcx, [rsp + 0x50]
call fcn.14004a080
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x140089083
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008906f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400890ad
call fcn.1400532f4
xor al, al
jmp 0x14008908c
test dil, dil
jne 0x140089087
bt eax, 0xa
jae 0x140089087
xor al, al
jmp 0x14008908c
shr eax, 4
and al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1400536a0
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret
call fcn.140059ac4
int3
Function at 0x1400890c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1400c9030]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x1400890f0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400891f1
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14008910c
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14004afe0
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x75
lea r8, str.T:p4depotLoL__MAIN__codeExternal_sentry_tmp_sentry_nativeexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.140049da0
nop
mov dword [rsp + 0x30], 3
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1400012e0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140089197
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140001da0
nop
lea rcx, [rsp + 0x50]
call fcn.14004a080
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1400891ed
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400891e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140089212
call fcn.1400532f4
xor al, al
jmp 0x1400891f9
test eax, 0x410
sete al
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1400536a0
add rsp, 0x180
pop rbx
ret
call fcn.140059ac4
int3
Function at 0x1400897b0
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1400c9030]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x1400897e0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400898e0
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400897fb
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14004afe0
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x30
lea r8, str.T:p4depotLoL__MAIN__codeExternal_sentry_tmp_sentry_nativeexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::LoggingRemoveDirectoryImpl_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.140049da0
nop
mov dword [rsp + 0x30], 3
lea rdx, str.RemoveDirectory
mov rcx, rax
call fcn.1400012e0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140089886
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140001da0
nop
lea rcx, [rsp + 0x50]
call fcn.14004a080
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1400898dc
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400898d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400898fb
call fcn.1400532f4
xor al, al
jmp 0x1400898e2
mov al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1400536a0
add rsp, 0x180
pop rbx
ret
call fcn.140059ac4
int3
Function at 0x140089910
Capabilities:
Check if file exists
Delete file

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1400c9030]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x140089940
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140089964
and eax, 0x410
cmp eax, 0x410
jne 0x140089964
mov rcx, rbx
call fcn.1400897b0
jmp 0x140089a73
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140089971
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140089a71
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14008998c
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14004afe0
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x95
lea r8, str.T:p4depotLoL__MAIN__codeExternal_sentry_tmp_sentry_nativeexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::LoggingRemoveFile_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.140049da0
nop
mov dword [rsp + 0x30], 3
lea rdx, str.DeleteFile
mov rcx, rax
call fcn.1400012e0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140089a17
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140001da0
nop
lea rcx, [rsp + 0x50]
call fcn.14004a080
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x140089a6d
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140089a68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140089a8c
call fcn.1400532f4
xor al, al
jmp 0x140089a73
mov al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1400536a0
add rsp, 0x180
pop rbx
ret
call fcn.140059ac4
int3
Function at 0x140089fa0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x140
mov rbx, rcx
mov dword [rsp + 0x158], 0
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx edx, ax
shr dx, 8
cmp al, 6
jb 0x14008a074
jne 0x140089fd8
cmp dx, 1
jbe 0x14008a074
mov ecx, dword [0x1400cc4a8]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1400cd918], eax
jg 0x14008a088
xor edx, edx
mov r8d, 0x10000000
mov rcx, rbx
call qword [0x1400cd910]
test eax, eax
jne 0x14008a07d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x21
lea r8, str.T:p4depotLoL__MAIN__codeExternal_sentry_tmp_sentry_nativeexternalcrashpadutilwincritical_section_with_debug_info.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::CrashpadInitializeCriticalSectionEx_struct__RTL_CRITICAL_SECTION__unsigned_long_unsigned_long_
lea rcx, [rsp + 0x30]
call fcn.140049da0
nop
mov dword [rsp + 0x158], 1
lea rdx, [0x1400a7f90]
mov rcx, rax
call fcn.1400012e0
nop
lea rcx, [rsp + 0x30]
call fcn.14004a080
xor al, al
add rsp, 0x140
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
add rsp, 0x140
pop rbx
ret
lea rcx, [0x1400cd918]
call fcn.140053484
cmp dword [0x1400cd918], 0xffffffff
jne 0x140089fff
mov r8b, 1
lea rdx, str.::InitializeCriticalSectionEx
lea rcx, str.kernel32.dll
call fcn.140046190
mov qword [0x1400cd910], rax
lea rcx, [0x1400cd918]
call fcn.140053424
jmp 0x140089fff
Function at 0x140001320
Capabilities:
Create process on windows
Self delete

Disassembly:
sub rsp, 0x418
mov rax, qword [0x1402e8ed8]
xor rax, rsp
mov qword [rsp + 0x400], rax
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.1401cbcd0
xorps xmm0, xmm0
lea rdx, [rsp + 0xe0]
xor eax, eax
mov r8d, 0x104
xor ecx, ecx
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r9, [rsp + 0xe0]
mov edx, 0x208
lea r8, str.cmd.exe__C_ping_1.1.1.1__n_1__w_2000___Nul__Del__f__q___s_
lea rcx, [rsp + 0x1f0]
call fcn.14000128c
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x1f0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.1401c9740
add rsp, 0x418
ret

Function at 0x140001400
Capabilities:
Create process on windows
Self delete

Disassembly:
sub rsp, 0x418
mov rax, qword [0x1402e8ed8]
xor rax, rsp
mov qword [rsp + 0x400], rax
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.1401cbcd0
xorps xmm0, xmm0
lea rdx, [rsp + 0xe0]
xor eax, eax
mov r8d, 0x104
xor ecx, ecx
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r9, [rsp + 0xe0]
mov edx, 0x208
lea r8, str.cmd.exe__C_ping_1.1.1.1__n_1__w_2000___Nul__Del__f__q___s___del__f__q_c:WinTemp__rmdir__S__Q_c:WinTemp
lea rcx, [rsp + 0x1f0]
call fcn.14000128c
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x1f0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.1401c9740
add rsp, 0x418
ret
Function at 0x140003a90
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rbp, rdx
mov rdi, rcx
call fcn.140098e0c
xor r14d, r14d
test eax, eax
je 0x140003ad3
cmp qword [rdi - 0x10], r14
jbe 0x140003acb
lea rbx, [rdi + 0x18]
add rbx, qword [rdi - 0x18]
jmp 0x140003ace
mov rbx, r14
mov rbx, qword [rbx]
jmp 0x140003ad6
mov rbx, r14
test rdi, rdi
jne 0x140003ae0
mov rax, r14
jmp 0x140003aed
mov edx, 0xfffc
mov rcx, rdi
call fcn.1401d7904
test rbx, rbx
je 0x140003b81
cmp dword [rbx + 0x50], r14d
je 0x140003b81
lea r8, [0x14025c114]
mov rdx, rax
mov rcx, rdi
call fcn.1400a0c68
lea rsi, [0x1402f1ca0]
mov ecx, 0x8000
mov rdx, rsi
lea ebx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rsp + 0x38], r14
mov r8, rsi
mov qword [rsp + 0x30], r14
mov r9d, eax
lea r14, [0x1402efca0]
mov dword [rsp + 0x28], 0x1000
xor edx, edx
mov qword [rsp + 0x20], r14
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rax, ebx
lea r8, [0x14025c118]
add rax, rdi
mov ebx, 0x10000
mov edx, ebx
mov qword [rsp + 0x20], rax
mov r9, r14
mov rcx, rsi
call fcn.1400011e0
jmp 0x140003ba1
mov ebx, 0x10000
lea rsi, [0x1402f1ca0]
mov edx, ebx
lea r8, [0x14025b994]
mov rcx, rsi
mov r9, rdi
call fcn.1400011e0
mov rdx, rbx
mov rcx, rsi
call fcn.1401d7904
cmp byte [rbp], 0x2e
mov rdx, rax
mov rcx, rsi
jne 0x140003bc6
lea r8, [0x14025c120]
call fcn.1400a0c68
jmp 0x140003bd4
lea r8, [0x14025c114]
call fcn.1400a0c68
inc eax
movsxd rcx, eax
lea r8, [0x14025b994]
sub rbx, rcx
mov r9, rbp
movsxd rcx, eax
mov rdx, rbx
add rcx, rsi
call fcn.1400011e0
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140007d68
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x30
and qword [rbp + 0x38], 0
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x140007d8f
and qword [rdx], 0
mov r8, qword [rcx + 0x38]
lea r12, [0x1402edca0]
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [0x14025c33c]
mov rdx, r12
lea rcx, [rbp + 0x38]
call fcn.1401d4a78
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140007f59
mov edx, 0xfffffff0
lea r8d, [rdx + 0x12]
call fcn.1401d5604
mov r9, qword [rbp + 0x38]
lea rcx, [0x1402f0ca0]
mov r8d, reloc.WS2_32.dll_recv
lea r15d, [r8 - 0xf]
mov edx, r15d
call fcn.1401d7e8c
mov rax, qword [0x1402f0ca0]
cmp rax, qword [0x1402e9b70]
jne 0x140007f50
mov rax, qword [0x1402f0ca8]
cmp rax, qword [0x1402e9b78]
jne 0x140007f50
mov rcx, qword [rbp + 0x38]
lea edx, [r15 - 0x15]
mov r8d, r15d
call fcn.1401d5604
mov r9, qword [rbp + 0x38]
lea r8d, [r15 + 3]
mov edx, r15d
lea rcx, [rbp + 0x30]
call fcn.1401d7e8c
cmp rax, 4
jne 0x140007f50
mov ecx, dword [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbp + 0x38]
lea edx, [r15 - 5]
sub edx, eax
mov dword [rbp + 0x30], eax
mov r8d, r15d
call fcn.1401d5604
movsxd rdx, dword [rbp + 0x30]
mov eax, 0xffffffff
mov rcx, rdx
cmp rdx, rax
jae 0x140007ea0
mov eax, 0xffffffe7
cmp rdx, rax
jae 0x140007ea0
add rcx, 0x18
call fcn.1401d7f54
mov edx, dword [rbp + 0x30]
jmp 0x140007ea2
xor eax, eax
movsxd rdx, edx
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call fcn.140098bdc
mov rdi, rax
test rbx, rbx
je 0x140007ebe
mov qword [rbx], rax
movsxd r8, dword [rbp + 0x30]
mov rdx, r15
mov r9, qword [rbp + 0x38]
mov rcx, rdi
call fcn.1401d7e8c
movsxd rcx, dword [rbp + 0x30]
cmp rax, rcx
jne 0x140007f50
test rbx, rbx
jne 0x140007f50
mov rcx, qword [rsi + 0x38]
lea rdx, str..msh
and qword [rbp + 0x40], rbx
call fcn.140003a90
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x1000
mov r8, rax
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [0x14025d0d0]
mov rdx, r12
lea rcx, [rbp + 0x40]
call fcn.1401d4a78
mov r9, qword [rbp + 0x40]
test r9, r9
je 0x140007f48
movsxd r8, dword [rbp + 0x30]
mov rdx, r15
mov rcx, rdi
call fcn.1401d6918
mov rcx, qword [rbp + 0x40]
call fcn.1401d52bc
mov rcx, rdi
call fcn.140098cbc
mov rcx, qword [rbp + 0x38]
call fcn.1401d52bc
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008110
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1402e8ed8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov edi, ecx
xor r9d, r9d
mov ecx, 0xbe8
xor r8d, r8d
xor edx, edx
call fcn.140098eb8
xor edx, edx
lea rcx, str.Shcore.dll
mov r8d, 0x800
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbx + 0x78], rax
test rax, rax
je 0x14000818f
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x80], rax
test rax, rax
jne 0x14000818f
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
and qword [rbx + 0x78], 0
mov ecx, 0x18
mov dword [rbx + 0x99c], 4
call fcn.140099308
mov rcx, rax
mov qword [rbx], rax
call fcn.1400a1c98
or edi, 0x118
mov qword [rbx + 0x30], rax
xor edx, edx
mov dword [rbx + 0x98], edi
mov r8d, 0x800
lea rcx, str.Ws2_32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x1400081f9
lea rdx, str.GetHostNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000822e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rbx + 0x9c]
mov edx, 0xff
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
movzx ecx, byte [rsp + 0x41]
mov edx, ecx
sub edx, 0x80
je 0x14000827f
cmp edx, 0x7f
jne 0x140008284
xor ecx, ecx
jmp 0x140008284
mov edx, 0x104
lea rcx, [rsp + 0x50]
call rax
test eax, eax
jne 0x140008274
and qword [rsp + 0x38], 0
lea rax, [rbx + 0x9c]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
mov dword [rsp + 0x28], 0xff
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14000820b
mov ecx, 3
mov dword [rbx + 0x9ac], ecx
mov edx, reloc.WS2_32.dll_recv
mov rax, qword [rbx]
test rax, rax
lea rcx, [rax + 0x9a8]
mov rax, rbx
cmove rcx, rdx
mov qword [rcx], rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401c9740
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x1400087cc
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, rdx
lea r8, [0x14025d204]
movzx edx, cx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
je 0x140008896
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140008896
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x140008896
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x140008896
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140008896
and dword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
and qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140008898
xor al, al
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14000d0c0
Capabilities:
Enumerate processes
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x1402e8ed8]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov eax, dword [0x14025e1f8]
lea rcx, [rbp + 0x77]
movups xmm0, xmmword [str.C:WinTemp_spoolsv.exe]
mov dword [rbp + 0x70], eax
xor edx, edx
movzx eax, word [0x14025e1fc]
mov r8d, 0xed
mov word [rbp + 0x74], ax
mov al, byte [0x14025e1fe]
mov byte [rbp + 0x76], al
movaps xmmword [rbp + 0x60], xmm0
call fcn.1401cbcd0
xor r9d, r9d
lea rax, [rbp + 0x170]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x23]
call qword [sym.imp.SHFOLDER.dll_SHGetFolderPathA]
test eax, eax
js 0x14000d16e
lea rdx, str._svchost_spoolsv.exe
lea rcx, [rbp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
xor ecx, ecx
mov al, byte [rbp + rcx + 0x170]
mov byte [rbp + rcx + 0x60], al
inc rcx
test al, al
jne 0x14000d15c
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x130
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x14000d22c
lea rdx, [0x14025e218]
lea rcx, [rsp + 0x5c]
call fcn.1401e3480
test eax, eax
jne 0x14000d21e
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000d21e
mov r9d, 0x104
lea r8, [rbp + 0x280]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x14000d21e
lea rcx, [rbp + 0x280]
lea rdx, [rbp + 0x60]
sub rdx, rcx
movzx eax, byte [rcx]
movzx r8d, byte [rcx + rdx]
sub eax, r8d
jne 0x14000d205
inc rcx
test r8d, r8d
jne 0x14000d1f0
test eax, eax
jne 0x14000d21e
lea edx, [rax + 9]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000d197
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1401c9740
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret