joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032390
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x258
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1403c6400]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov dword [rsp + 0x50], 0
lea rdx, [rsp + 0x80]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140032543
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], sendto
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x220]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.WS2_32.dll_WSAStringToAddressW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x140032455
mov dword [rsp + 0x44], 0x1c
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x220]
xor r8d, r8d
mov edx, reloc.WS2_32.dll_socket
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.WS2_32.dll_WSAStringToAddressW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x14003253d
lea rcx, [rsp + 0x48]
call fcn.140004410
nop
mov edx, 0x104
lea rcx, [rsp + 0x48]
call fcn.140008920
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x104
mov r8, rax
mov edx, 0x1c
lea rcx, [rsp + 0x220]
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov dword [rsp + 0x40], eax
mov edx, 0xffffffff
lea rcx, [rsp + 0x48]
call fcn.1400586a0
cmp dword [rsp + 0x40], 0
jne 0x140032533
lea rcx, [rsp + 0x48]
call fcn.140007860
movzx eax, al
test eax, eax
jne 0x140032533
lea rcx, [rsp + 0x48]
call fcn.140003250
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x48]
call fcn.140003fd0
cdqe
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x48]
call fcn.140003250
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x268]
call fcn.14004a000
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x48]
call fcn.1400031c0
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140263a60
add rsp, 0x258
ret
Function at 0x1400340b0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1403c6400]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140034123
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x80]
mov dword [rax], 0
xor al, al
jmp 0x1400341d1
mov r8d, 4
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140034165
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
mov rax, qword [rsp + 0x80]
mov dword [rax], 0
xor al, al
jmp 0x1400341d1
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400341a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400341d1
mov rax, qword [rsp + 0x78]
mov dword [rax], 0
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x34]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140263a60
add rsp, 0x68
ret
Function at 0x140035160
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x298
mov rax, qword [0x1403c6400]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, sendto
mov ecx, 2
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x6f
jne 0x140035245
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
xor r8d, r8d
mov edx, sendto
mov ecx, 2
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140035243
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x30]
jmp 0x140035339
jmp 0x14003524e
mov eax, dword [rsp + 0x30]
jmp 0x140035339
cmp qword [rsp + 0x40], 0
jne 0x140035260
mov eax, 8
jmp 0x140035339
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0x104
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x2a0]
cmp dword [rax + 4], ecx
jne 0x140035307
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400352a5
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140035307
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
and eax, 1
cmp eax, 1
jne 0x140035305
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rax, qword [rsp + 0x38]
mov edx, dword [rax + 0x18]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.WS2_32.dll_WSAAddressToStringW]
test eax, eax
jne 0x140035305
mov eax, dword [rsp + 0x48]
mov r8d, eax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x2a8]
call fcn.140003740
jmp 0x140035307
jmp 0x140035297
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x140035272
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140263a60
add rsp, 0x298
ret
Function at 0x140035f10
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x24], 0
xor edx, edx
mov rcx, qword [rsp + 0x60]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140035f69
jmp 0x140036014
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0x40]
mov r8, rcx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140035f9f
jmp 0x140036014
mov r9, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x140035fbd
jmp 0x140036014
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x38]
lea rdx, [0x1402e1138]
mov rcx, qword [rsp + 0x30]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x140035fe0
jmp 0x140036014
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0xfeef04bd
je 0x140035ff1
jmp 0x140036014
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
mov dword [rsp + 0x24], eax
cmp qword [rsp + 0x68], 0
je 0x140036014
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0xc]
mov dword [rax], ecx
cmp qword [rsp + 0x30], 0
je 0x140036032
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x24]
add rsp, 0x58
ret

Function at 0x140036540
Capabilities:
Check os version

Disassembly:
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and rax, 0xffff
movzx eax, ax
and rax, 0xff
movzx eax, al
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
and rax, 0xffff
movzx eax, ax
shr rax, 8
and rax, 0xff
movzx eax, al
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x24], 6
ja 0x14003659b
cmp dword [rsp + 0x24], 6
jne 0x1400365a4
cmp dword [rsp + 0x28], 1
jb 0x1400365a4
mov eax, 1
jmp 0x1400365a6
xor eax, eax
add rsp, 0x38
ret
Function at 0x140037160
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x24], 0x105
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x38], rax
mov eax, 2
mov rcx, qword [rsp + 0x38]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d6048
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x140037281
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.1400d6040
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x14003720d
xor al, al
jmp 0x140037315
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x50], rax
mov eax, 2
mov rcx, qword [rsp + 0x50]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d6048
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x140037281
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1400d6040
xor al, al
jmp 0x140037315
mov byte [rsp + 0x20], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
jmp 0x1400372ab
mov rcx, qword [rsp + 0x30]
call fcn.14026f9f4
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x30], rax
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx + rax]
test eax, eax
je 0x1400372f3
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx + rax]
cmp eax, 0x3a
jne 0x1400372f1
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x88]
call fcn.1400032d0
mov byte [rsp + 0x20], 1
jmp 0x1400372f3
jmp 0x140037292
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.1400d6040
mov qword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x78
ret

Function at 0x1400377d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call fcn.140003570
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x14003780d
mov eax, dword [rsp + 0x20]
and eax, 0x10
cmp eax, 0x10
je 0x14003780d
mov dword [rsp + 0x24], 1
jmp 0x140037815
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
add rsp, 0x38
ret
Function at 0x140037c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1d8
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov rax, qword [0x1403c6400]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov dword [rsp + 0x20], 0
mov r8d, 1
mov edx, 2
lea rcx, [rsp + 0xc0]
call fcn.140050b80
nop
mov rax, qword [rsp + 0xc0]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0xc0]
mov qword [rsp + 0x48], rax
mov dl, 0x30
mov rcx, qword [rsp + 0x48]
call fcn.140069ee0
lea rdx, [0x14006a660]
lea rcx, [rsp + 0xc0]
call fcn.140054a80
mov byte [rsp + 0x1b0], 0x2d
mov byte [rsp + 0x1b1], 0x5f
mov byte [rsp + 0x1b2], 0x2e
mov byte [rsp + 0x1b3], 0x7e
mov byte [rsp + 0x1b4], 0x3a
mov byte [rsp + 0x1b5], 0x2f
mov byte [rsp + 0x1b6], 0x26
mov byte [rsp + 0x1b7], 0x3f
mov byte [rsp + 0x1b8], 0x3d
lea rax, [rsp + 0x1b9]
mov r8, rax
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x80]
call fcn.14003bef0
nop
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.140026e00
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call fcn.140066080
mov qword [rsp + 0x50], rax
jmp 0x140037d5c
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x28], rax
je 0x140037e78
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movsx eax, byte [rax]
mov ecx, eax
call fcn.140277a6c
test eax, eax
jne 0x140037dd8
mov r8, qword [rsp + 0x30]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x80]
call fcn.140069f30
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x80]
call fcn.1400690f0
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140054d60
movzx eax, al
test eax, eax
je 0x140037df2
mov rax, qword [rsp + 0x30]
movzx edx, byte [rax]
lea rcx, [rsp + 0xc0]
call fcn.14003ca10
jmp 0x140037d4f
lea rdx, [0x14006f010]
lea rcx, [rsp + 0xc0]
call fcn.140054a80
mov dl, 0x25
lea rcx, [rsp + 0xc0]
call fcn.14003ca10
mov qword [rsp + 0x70], rax
mov edx, 2
lea rcx, [rsp + 0xa8]
call fcn.1402663cc
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.14003c9c0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
call fcn.1400547d0
lea rdx, [0x14006b330]
lea rcx, [rsp + 0xc0]
call fcn.140054a80
jmp 0x140037d4f
mov rdx, qword [rsp + 0x1e0]
lea rcx, [rsp + 0xc0]
call fcn.14006e660
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x80]
call fcn.140053c30
nop
lea rcx, [rsp + 0xc0]
call fcn.140056810
mov rax, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140263a60
add rsp, 0x1d8
ret
Function at 0x140038340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1a8
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1403c6400]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x130]
call fcn.14002b2e0
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0xb0]
call fcn.140006080
nop
lea rcx, [rsp + 0x130]
call fcn.1400049b0
lea r8, [0x1402e1958]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.14003d750
nop
lea rcx, [rsp + 0x50]
call fcn.1400032f0
nop
lea rcx, [rsp + 0x70]
call fcn.140003570
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140038486
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xd0]
call fcn.14004f430
nop
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x150]
call fcn.140028f80
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.14000ad60
lea rcx, [rsp + 0x150]
call fcn.1400049b0
nop
lea rcx, [rsp + 0xd0]
call fcn.1400049b0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x1b0]
call fcn.140006080
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
call fcn.1400049b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400049b0
nop
lea rcx, [rsp + 0xb0]
call fcn.1400049b0
mov rax, qword [rsp + 0x1b0]
jmp 0x1400385da
lea rcx, [rsp + 0x90]
call fcn.1400032f0
nop
lea rdx, [rsp + 0x90]
lea rcx, [0x1402e19b0]
call fcn.1400ac760
cmp eax, 1
jne 0x1400384f6
lea rdx, [0x1402e1a00]
lea rcx, [rsp + 0xf0]
call fcn.1400055b0
nop
mov eax, dword [rsp + 0x20]
or eax, 2
mov dword [rsp + 0x20], eax
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x90]
call fcn.1400acc10
cmp eax, 1
jne 0x1400384f6
mov dword [rsp + 0x28], 1
jmp 0x1400384fe
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x24], al
mov eax, dword [rsp + 0x20]
and eax, 2
test eax, eax
je 0x140038524
and dword [rsp + 0x20], 0xfffffffd
lea rcx, [rsp + 0xf0]
call fcn.1400049b0
movzx eax, byte [rsp + 0x24]
test eax, eax
je 0x140038584
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x110]
call fcn.14004f430
nop
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x170]
call fcn.140028f80
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.14000ad60
lea rcx, [rsp + 0x170]
call fcn.1400049b0
nop
lea rcx, [rsp + 0x110]
call fcn.1400049b0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x1b0]
call fcn.140006080
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x90]
call fcn.1400049b0
nop
lea rcx, [rsp + 0x50]
call fcn.1400049b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400049b0
nop
lea rcx, [rsp + 0xb0]
call fcn.1400049b0
mov rax, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140263a60
add rsp, 0x1a8
ret
Function at 0x14003adf0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x250
mov rax, qword [0x1403c6400]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14003ae5c
mov eax, 2
imul rax, rax, 3
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x208
jae 0x14003ae4b
jmp 0x14003ae50
call fcn.14026431c
xor eax, eax
mov rcx, qword [rsp + 0x28]
mov word [rsp + rcx + 0x30], ax
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x30]
mov ecx, eax
call fcn.1402780d0
cmp eax, 0x78
jne 0x14003ae80
mov dword [rsp + 0x20], 1
jmp 0x14003ae88
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140263a60
add rsp, 0x250
pop rdi
ret

Function at 0x14003b0d0
Capabilities:
Get common file path

Disassembly:
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea rdx, [0x1402e14f0]
mov rcx, qword [rsp + 0x60]
call fcn.140004120
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x28]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x14003b1b2
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x14003b192
mov edx, 0x104
mov rcx, qword [rsp + 0x60]
call fcn.140057cc0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x48]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call fcn.1400118c0
jmp 0x14003b1a2
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
call qword [rax + 0x10]
cmp dword [rsp + 0x68], 5
je 0x14003b1c0
cmp dword [rsp + 0x68], 0
jne 0x14003b1d3
lea rdx, [0x1402e1394]
mov rcx, qword [rsp + 0x60]
call fcn.140011410
jmp 0x14003b200
movzx eax, byte [rsp + 0x70]
test eax, eax
je 0x14003b1ef
lea rdx, str.Macrium_
mov rcx, qword [rsp + 0x60]
call fcn.140011410
jmp 0x14003b200
lea rdx, [0x1402e1510]
mov rcx, qword [rsp + 0x60]
call fcn.140011410
add rsp, 0x58
ret
Function at 0x14003b290
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x48], 0xfffffffffffffffe
lea rcx, str.AdvAPI32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14003b33b
lea rdx, [0x1402e2b58]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14003b330
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x68]
call fcn.140003250
xor r9d, r9d
mov r8d, 0x100
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x68]
call fcn.1400031c0
mov eax, dword [rsp + 0x24]
jmp 0x14003b365
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x68]
call fcn.140003250
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x68]
call fcn.1400031c0
mov eax, dword [rsp + 0x28]
add rsp, 0x58
ret
Function at 0x140057670
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x14005769a
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0
jne 0x1400576e3
mov rax, qword [rsp + 0x40]
add rax, 8
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
add rsp, 0x38
ret
Function at 0x14007e790
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2b8
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1403c6400]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov dword [rsp + 0x28], 0x104
mov byte [rsp + 0x20], 0
mov rcx, qword [rsp + 0x2c0]
call fcn.14000b1b0
movzx eax, word [rax]
cmp eax, 0x5c
je 0x14007e7ed
lea rdx, [0x1402eb63c]
mov rcx, qword [rsp + 0x2c0]
call fcn.140005570
mov rcx, qword [rsp + 0x2c0]
call fcn.14000ad50
cmp rax, 3
jae 0x14007e807
xor al, al
jmp 0x14007e99d
mov r9d, 3
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x2c0]
call fcn.14000ac20
nop
lea rcx, [rsp + 0x50]
call fcn.140003570
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 4
je 0x14007e84c
cmp dword [rsp + 0x24], 1
jne 0x14007e985
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
call fcn.140003570
lea r9, [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov edx, 2
mov rcx, rax
call sub.MPR.dll_WNetGetUniversalNameW
test eax, eax
jne 0x14007e8c2
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14007e8bd
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.14026f9f4
test rax, rax
jbe 0x14007e8bd
mov rax, qword [rsp + 0x30]
mov r9, qword [rax]
mov r8d, 3
xor edx, edx
mov rcx, qword [rsp + 0x2c0]
call fcn.14006c8e0
mov byte [rsp + 0x20], 1
jmp 0x14007e985
mov eax, 2
imul rax, rax, 0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x208
jae 0x14007e8dd
jmp 0x14007e8e2
call fcn.14026431c
xor eax, eax
mov rcx, qword [rsp + 0x38]
mov word [rsp + rcx + 0x90], ax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000ac20
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.140003570
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x90]
mov rcx, rax
call sub.MPR.dll_WNetGetConnectionW
lea rcx, [rsp + 0x70]
call fcn.1400049b0
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x90]
cmp eax, 0x5c
jne 0x14007e985
mov eax, 2
imul rax, rax, 1
movzx eax, word [rsp + rax + 0x90]
cmp eax, 0x5c
jne 0x14007e985
lea r9, [rsp + 0x90]
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x2c0]
call fcn.14006c8e0
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x50]
call fcn.1400049b0
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140263a60
add rsp, 0x2b8
ret