joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140153154
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
mov eax, WSACleanup
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rsi, rcx
lea rdx, [rbp - 0x30]
mov rcx, qword [rbx + 8]
call fcn.1401596d0
mov r8d, 1
lea rdx, [0x14028e2fc]
lea rcx, [rbp - 0x30]
call fcn.14002a4c8
mov rdx, qword [rbx + 0x10]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1401531ab
lea rcx, [rbp - 0x30]
call fcn.14002a4c8
nop
lea rcx, [rsi + 0x20]
mov qword [rbp - 0x50], rcx
and dword [rbp - 0x48], 0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
lock inc dword [rbp - 0x48]
mov rcx, qword [rsi]
test rcx, rcx
je 0x1401532a7
call fcn.14015357c
mov rbx, qword [rsi]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rbp - 0x20]
test r8, r8
je 0x14015322c
movzx eax, byte [rcx + rdx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14015320f
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.140153c70
mov rdi, qword [rax + 8]
test rdi, rdi
jne 0x140153249
mov rdi, qword [rbx + 8]
test rbx, rbx
je 0x1401532a7
mov rcx, rbx
call fcn.14015357c
mov rax, qword [rsi]
cmp rdi, qword [rax + 8]
setne bl
mov eax, dword [rbp - 0x48]
test eax, eax
jmp 0x14015327d
lock dec dword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov ecx, dword [rbp - 0x48]
test ecx, ecx
jne 0x140153267
nop
lea rcx, [rbp - 0x30]
call fcn.14000fd30
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov ecx, 0x131f486
call fcn.1400b3928
int3
Function at 0x1401532b4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
mov eax, WSACleanup
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rsi, rcx
lea rdx, [rbp - 0x30]
mov rcx, qword [rbx + 8]
call fcn.1401596d0
mov r8d, 1
lea rdx, [0x14028e2fc]
lea rcx, [rbp - 0x30]
call fcn.14002a4c8
mov rdx, qword [rbx + 0x10]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14015330b
lea rcx, [rbp - 0x30]
call fcn.14002a4c8
nop
lea rcx, [rsi + 0x20]
mov qword [rbp - 0x50], rcx
and dword [rbp - 0x48], 0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
lock inc dword [rbp - 0x48]
mov rcx, qword [rsi]
test rcx, rcx
je 0x14015340e
call fcn.14015357c
mov rdi, qword [rsi]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rbp - 0x20]
test r8, r8
je 0x14015338c
movzx eax, byte [rcx + rdx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14015336f
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.140153c70
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x1401533a9
mov rbx, qword [rdi + 8]
test rdi, rdi
je 0x14015340e
mov rcx, rdi
call fcn.14015357c
mov rax, qword [rsi]
cmp rbx, qword [rax + 8]
je 0x1401533c5
movzx ebx, word [rbx + 0x30]
jmp 0x1401533c7
xor ebx, ebx
mov eax, dword [rbp - 0x48]
test eax, eax
jmp 0x1401533e4
lock dec dword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov ecx, dword [rbp - 0x48]
test ecx, ecx
jne 0x1401533ce
lea rcx, [rbp - 0x30]
call fcn.14000fd30
movzx eax, bx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov ecx, 0x131f486
call fcn.1400b3928
int3
Function at 0x140153a44
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
jbe 0x140153a99
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbp, qword [rsi + 8]
lea rax, [rdx - 1]
or rax, 1
lea r12, [rsi + 0x18]
bsr rcx, rax
mov ebx, 1
mov r8, rbp
inc ecx
shl rbx, cl
mov rcx, r12
lea rdx, [rbx + rbx]
call fcn.1400b57b4
lea rax, [rbx - 1]
mov qword [rsi + 0x38], rbx
mov qword [rsi + 0x30], rax
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rbp
je 0x140153c50
mov rdi, qword [rdi]
lea r15, [rbx + 0x10]
cmp qword [r15 + 0x18], 0x10
mov r8, r15
mov r13, qword [r15 + 0x10]
jb 0x140153afd
mov r8, qword [r15]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r13, r13
je 0x140153b2c
movzx eax, byte [rdx + r8]
movabs r9, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r9
cmp rdx, r13
jb 0x140153b0e
mov r14, qword [rsi + 0x30]
mov r12, qword [r12]
and r14, rcx
add r14, r14
cmp qword [r12 + r14*8], rbp
jne 0x140153b4e
mov qword [r12 + r14*8], rbx
mov qword [r12 + r14*8 + 8], rbx
jmp 0x140153c40
mov rsi, qword [r12 + r14*8 + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0x10
mov rax, qword [rdx + 0x10]
jb 0x140153b65
mov rdx, qword [rdx]
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x140153b72
mov rcx, qword [r15]
cmp r13, rax
jne 0x140153bb6
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140153bb6
mov r8, qword [rsi]
cmp r8, rbx
je 0x140153bac
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r14*8 + 8], rbx
jmp 0x140153c3b
cmp qword [r12 + r14*8], rsi
je 0x140153c16
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0x10
mov rax, qword [rdx + 0x10]
jb 0x140153bd2
mov rdx, qword [rdx]
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x140153bdf
mov rcx, qword [r15]
cmp r13, rax
jne 0x140153bb6
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140153bb6
mov r8, qword [rsi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x140153c3b
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rsi
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov qword [rsi + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r14*8], rbx
mov rsi, qword [rsp + 0x50]
lea r12, [rsi + 0x18]
mov rbx, rdi
cmp rdi, rbp
jne 0x140153ae5
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14015d360
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
mov eax, 0x80
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov word [rbp - 0xc], 0x500
lea rax, [rbp - 0x18]
mov dword [rbp - 0x20], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], ebx
mov r9d, r8d
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov dword [rbp - 0x10], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14015d3eb
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and dword [rbp - 0x20], ecx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp - 0x20]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x14015d40c
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
mov eax, 0xb0
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp + 0x27], rax
and qword [rbp - 0x41], 0
xor ebx, ebx
and dword [rbp - 0x49], ebx
mov rsi, rcx
xor edx, edx
lea rcx, [rbp - 0x29]
lea edi, [rbx + 0x44]
mov r8d, edi
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x39], edi
test rsi, rsi
jne 0x14015d484
mov ecx, 0x15b3c8
call fcn.1400bc714
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14015d47d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14015d5e0
cmp dword [0x14037d658], ebx
je 0x14015d49e
mov eax, dword [0x140367cc8]
mov dword [rsi], eax
mov eax, 1
jmp 0x14015d5e0
and dword [rsi], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x41]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14015d4c6
mov ecx, 0x15b3c9
jmp 0x14015d5b5
mov rcx, qword [rbp - 0x41]
lea rax, [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edi, [r9 + 2]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14015d4f3
mov ecx, 0x15b3ca
jmp 0x14015d5b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14015d508
mov ecx, 0x15b3cb
jmp 0x14015d5b5
mov ecx, dword [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
je 0x14015d5b0
mov r9d, dword [rbp - 0x49]
mov rbx, rax
mov rcx, qword [rbp - 0x41]
lea rax, [rbp - 0x49]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14015d547
mov ecx, 0x15b3cd
jmp 0x14015d5b5
xor edx, edx
lea r9, [rbp - 0x39]
lea r8, [rbp - 0x29]
lea ecx, [rdx + 0xb]
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x14015d565
mov ecx, 0x15b3ce
jmp 0x14015d5b5
xor r14d, r14d
lea edi, [r14 + 1]
cmp r14d, dword [r15]
jae 0x14015d5a0
mov r12d, r14d
add r12, r12
mov rcx, qword [r15 + r12*8 + 8]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x14015d599
mov rdx, qword [r15 + r12*8 + 8]
lea rcx, [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14015d59e
add r14d, edi
jmp 0x14015d56c
mov dword [rsi], edi
mov eax, dword [rsi]
mov dword [0x140367cc8], eax
mov dword [0x14037d658], edi
jmp 0x14015d5bc
mov ecx, 0x15b3cc
call fcn.1400bc714
xor edi, edi
test rbx, rbx
je 0x14015d5ca
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14015d5de
and qword [rbp - 0x41], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14024c6d0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140174c88
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x3e0
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x140174d61
cmp qword [rdx + 0x18], 8
mov dword [rsp + 0x30], FCIDestroy
mov dword [rsp + 0x34], 8
jb 0x140174cda
mov rdx, qword [rdx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140174d0b
cmp eax, 2
je 0x140174d07
cmp eax, 0xea
jne 0x140174d34
xor al, al
jmp 0x140174d13
cmp dword [rsp + 0x30], 0xb
sete al
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0x408]
add rsp, 0x3e0
pop rdi
ret
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.1400107f8
lea rdx, [0x140325060]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea r8, str.ORegistryKey.GetValue_failure:_Cannot_get_QWORD_value._The_registry_key_is_closed_or_not_set
lea rcx, [rsp + 0x40]
call fcn.140012410
lea rdx, [0x140325060]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140181dd8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
mov rbp, rsp
mov eax, 0x60
call fcn.14024eae0
sub rsp, rax
mov al, byte [0x14037e5c5]
lea rsi, vtable.Mso::Registry::Key.0
and qword [rbp - 0x18], 0
mov rbx, rcx
neg al
mov dword [rbp - 0x20], 1
lea rax, [rbp - 0x18]
mov qword [rbp - 0x28], rsi
sbb r9d, r9d
mov byte [rbp - 0x10], 1
and r9d, 0x100
mov qword [rsp + 0x20], rax
add r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140181e8d
and dword [rbp + 0x20], eax
lea r9, [rbp - 0x30]
and dword [rbp - 0x30], eax
lea rdx, str.SendTelemetry
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp + 0x20]
mov dword [rbp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140181e8d
mov eax, dword [rbp + 0x20]
mov dword [rbx], eax
mov byte [rbx + 4], 1
jmp 0x140181e94
and dword [rbx], 0
mov byte [rbx + 4], 0
cmp byte [rbp - 0x10], 0
mov qword [rbp - 0x28], rsi
je 0x140181ead
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140181ead
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140186bec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rbx, qword [rdx + 0x10]
or r9, 0xffffffffffffffff
mov rcx, r9
xor r8d, r8d
mov rdi, rdx
inc rcx
cmp byte [rbx + rcx], r8b
jne 0x140186c0c
movabs r11, 0xcbf29ce484222325
mov rdx, r8
mov r10, r11
movabs rsi, 0x100000001b3
test rcx, rcx
je 0x140186c47
movzx eax, byte [rdx + rbx]
inc rdx
xor r10, rax
imul r10, rsi
cmp rdx, rcx
jb 0x140186c34
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
mov rdx, qword [rax + rcx*8 - 8]
inc r9
cmp byte [rdx + r9], r8b
jne 0x140186c57
test r9, r9
je 0x140186c79
movzx eax, byte [rdx + r8]
inc r8
xor r11, rax
imul r11, rsi
cmp r8, r9
jb 0x140186c65
mov rbx, qword [rsp + 8]
mov rcx, r10
mov rsi, qword [rsp + 0x10]
mov rdx, r10
mov rdi, qword [rsp + 0x18]
mov eax, 0x9e3779b9
shl rcx, 6
shr rdx, 2
add rcx, r11
add rax, rdx
add rax, rcx
xor rax, r10
ret

Function at 0x140187fe0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x3d0
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov edx, 0x101
lea rsi, [rcx + 0x10]
xor ebp, ebp
mov dword [rsp + 0x20], edx
lea rdi, [rcx + 0x18]
mov rbx, rcx
cmp qword [rsi], rdx
jb 0x140188042
cmp qword [rdi], 8
mov rax, rcx
jb 0x140188036
mov rax, qword [rcx]
mov qword [rsi], rdx
mov word [rax + 0x202], bp
jmp 0x14018804d
sub rdx, qword [rsi]
xor r8d, r8d
call fcn.14000aabc
cmp qword [rdi], 8
mov rcx, rbx
jb 0x140188059
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1401880ba
mov edx, dword [rsp + 0x20]
cmp rdx, qword [rsi]
ja 0x140188083
cmp qword [rdi], 8
jb 0x14018807a
mov rbx, qword [rbx]
mov qword [rsi], rdx
mov word [rbx + rdx*2], bp
jmp 0x140188091
sub rdx, qword [rsi]
xor r8d, r8d
mov rcx, rbx
call fcn.14000aabc
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.14024c6d0
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, str.Failed_to_get_current_computername.
lea rcx, [rsp + 0x30]
call fcn.140010370
lea rdx, [0x140325060]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14018aa28
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x3f0
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
cmp qword [rcx + 0x18], 8
mov dil, dl
mov rbx, rcx
jb 0x14018aa5d
mov rcx, qword [rcx]
lea r8, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14018aa9a
cmp dword [rsp + 0x20], 0xffffffff
je 0x14018aa9a
test byte [rsp + 0x20], 0x10
je 0x14018aa9a
cmp qword [rbx + 0x18], 8
jb 0x14018aa86
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14018aa9a
test dil, dil
jne 0x14018aabd
jmp 0x14018aa9c
mov al, 1
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0x408]
add rsp, 0x3f0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.140189d10
lea rdx, [0x140325060]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14018b94c
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
and dword [rsp + 0x40], 0
mov rsi, rdx
mov rbx, rcx
call fcn.1400293f0
test al, al
je 0x14018b9cf
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14018b985
mov rcx, qword [rbx]
lea rdx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x14018b9cf
mov edx, edi
mov rcx, rsi
call fcn.14002a118
mov rdx, qword [rsi + 8]
sub rdx, qword [rsi]
neg rdx
sbb r9, r9
and r9, qword [rsi]
cmp qword [rbx + 0x18], 8
jb 0x14018b9ba
mov rbx, qword [rbx]
mov r8d, edi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
setne al
jmp 0x14018b9d1
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14018b9e4
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x3f0
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
cmp qword [rdx + 0x18], 8
jb 0x14018ba28
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x14018ba32
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14018ba7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x30], eax
cmp eax, 5
jne 0x14018bab4
mov rcx, rbx
call fcn.1400403f0
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14018ba65
mov rdx, qword [rbx]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14018ba72
mov rcx, qword [rdi]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14018baa4
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.14024c6d0
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
jmp 0x14018bab4
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r8d, esi
lea rcx, [rsp + 0x50]
call fcn.14018be08
lea rdx, [0x140325060]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14018bae0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r13
push r15
lea rbp, [rsp - 0x310]
mov eax, 0x410
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov rbx, rdx
mov rdi, rcx
mov esi, 8
cmp qword [rcx + 0x18], rsi
jb 0x14018bb26
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
xor r15d, r15d
cmp eax, 1
je 0x14018bc4a
mov rcx, rbx
cmp qword [rbx + 0x18], rsi
jb 0x14018bb44
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
cmp eax, 1
je 0x14018bc4a
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov r13d, 7
mov qword [rsp + 0x68], r13
mov word [rsp + 0x50], r15w
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r13
mov word [rsp + 0x30], r15w
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14018c62c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14018c62c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400112c4
movzx r11d, al
lea esi, [r11*2 + 8]
mov rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x14018bbf9
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14018bbf3
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14018bbf3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r13
mov word [rsp + 0x30], r15w
mov rax, qword [rsp + 0x68]
cmp rax, 8
jb 0x14018bc4a
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, 0x1000
jb 0x14018bc44
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14018bc44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
or esi, 1
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14018bc5a
mov rdx, qword [rbx]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14018bc67
mov rcx, qword [rdi]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14018bcae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14018bcd4
mov rcx, rbx
call fcn.1400403f0
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14018bc94
mov rdx, qword [rbx]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14018bca1
mov rcx, qword [rdi]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14018bcd4
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0x450]
add rsp, 0x410
pop r15
pop r13
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x70]
call fcn.14018bef0
lea rdx, [0x140325060]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14018df54
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x360]
mov eax, 0x460
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp + 0x350], rax
cmp qword [rcx + 8], 0xffffffffffffffff
mov rdi, r8
mov rsi, rdx
mov byte [rsp + 0x40], 1
mov rbx, rcx
je 0x14018dfa6
xor edx, edx
call fcn.14018d948
test al, al
je 0x14018e0a5
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rsi
call fcn.14018e6fc
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x70]
call sub.VCRUNTIME140.dll_memset
mov al, byte [rsp + 0x40]
lea rdx, str.runas
and qword [rsp + 0x58], 0
neg al
mov dword [rsp + 0x50], WSACleanup
mov rax, rsi
sbb rcx, rcx
and rcx, rdx
cmp qword [rsi + 0x18], 8
mov qword [rsp + 0x60], rcx
jb 0x14018e002
mov rax, qword [rsi]
cmp qword [rdi + 0x18], 8
mov qword [rsp + 0x68], rax
mov rax, rdi
jb 0x14018e014
mov rax, qword [rdi]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x80], 0x8000000
mov dword [rsp + 0x54], 0x340
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x14018e04e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x10], eax
mov r8d, eax
cmp eax, 0x4c7
jne 0x14018e081
xor al, al
jmp 0x14018e05f
mov rcx, qword [rbp - 0x48]
mov al, 1
mov qword [rbx + 8], rcx
mov dword [rbx + 0x10], 0x103
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0x498]
add rsp, 0x460
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x28], rdi
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rsi
call fcn.14018e520
lea rdx, [0x140325060]
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rcx, [rbp - 0x40]
call fcn.14018e0c0
lea rdx, [0x140325060]
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3