joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b8d0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14003b93f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003b93f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003b93f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003b93f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003b93f
cmp dword [rcx + 0x84], 0xe
jbe 0x14003b93f
cmp dword [rcx + 0xf8], 0
je 0x14003b93f
mov ecx, ebx
call fcn.14003b9f0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14003b7cc
nop
cmp dword [rbp + 0x20], 0
je 0x14003b98d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14003b998
int3
xor r8d, r8d
xor edx, edx
jmp 0x14003b8d0

Function at 0x14003bad4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14003b93f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003b93f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003b93f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003b93f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003b93f
cmp dword [rcx + 0x84], 0xe
jbe 0x14003b93f
cmp dword [rcx + 0xf8], 0
je 0x14003b93f
mov ecx, ebx
call fcn.14003b9f0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14003b7cc
nop
cmp dword [rbp + 0x20], 0
je 0x14003b98d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14003b998
int3
xor r8d, r8d
xor edx, edx
jmp 0x14003b8d0
Function at 0x14004bd20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14004bda7
mov rsi, rbx
cmp word [rax], bp
je 0x14004bd66
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14004bd50
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14004bd4c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140047f4c
mov rdi, rax
test rax, rax
je 0x14004bd94
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400519e0
mov rbp, rdi
xor ecx, ecx
call fcn.140047404
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14004f158
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14004f16e
mov al, 1
jmp 0x14004f1ce
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14004f17f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14004f1cc
mov ecx, dword [rcx + 0x18]
nop
call fcn.14004c068
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004f1cc
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14004f1cc
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14004f1cc
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14004f1ce
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140051830
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140051858
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140051858
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180001028
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
xor r8d, r8d
mov edx, 0x400000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
test rax, rax
mov qword [0x18000d350], rax
jne 0x180001065
mov eax, 8
jmp 0x18000120e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
mov dword [0x18000d348], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [0x18000d398], rax
je 0x1800010ec
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jne 0x1800010a4
movzx ecx, ax
shr cx, 8
jne 0x1800010a6
cmp al, al
jbe 0x1800010e5
mov dword [0x18000d378], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x47a
mov r8d, eax
mov qword [0x18000d380], rsi
mov dword [0x18000d36c], eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
or rcx, 0xffffffffffffffff
test rax, rax
cmove rax, rcx
mov qword [0x18000d370], rax
xor eax, eax
jmp 0x1800010f2
mov eax, 0x32
jmp 0x1800010f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18000120e
xor eax, eax
xor edi, edi
lea rdx, str..bss
lea r8d, [rdi + 8]
lea rcx, [rsp + 0x48]
mov byte [rsp + 0x48], dil
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
movsxd r11, dword [rsi + 0x3c]
mov r8d, dword [rsp + 0x4c]
add r11, rsi
xor ebx, ebx
movzx eax, word [r11 + 0x14]
movzx edx, word [r11 + 6]
lea rcx, [rax + r11 + 0x18]
mov eax, dword [rsp + 0x48]
cmp dword [rcx], eax
jne 0x180001153
cmp dword [rcx + 4], r8d
cmove rbx, rcx
add rcx, 0x28
add edx, 0xffffffff
je 0x180001161
test rbx, rbx
je 0x180001147
test rbx, rbx
je 0x1800011fe
cmp dword [rbx + 0xc], edi
je 0x1800011f7
cmp dword [rbx + 0x10], edi
je 0x1800011f7
mov rax, qword [str.Jul_13_2017]
mov edx, dword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov eax, dword [0x18000b3c0]
mov r9d, 1
mov dword [rcx + 8], eax
mov ecx, dword [rbx + 0xc]
lea ebp, [rcx + rdx]
add rcx, rsi
xor ebp, dword [rsp + 0x20]
xor ebp, dword [rsp + 0x24]
lea r8d, [rbp + 0xe]
call fcn.1800057c4
mov r11d, dword [0x18000f1ff]
xor r11d, dword [0x18000f203]
xor r11d, dword [0x18000f20b]
cmp r11d, 0x73686c70
mov dword [0x18000d3a4], r11d
je 0x180001203
mov ecx, dword [rbx + 0xc]
mov edx, dword [rbx + 0x10]
lea r8d, [rbp + 0xe]
add rcx, rsi
mov r9d, 1
call fcn.180005780
mov edi, 0xc
jmp 0x180001203
mov edi, 0xc0
jmp 0x180001203
mov edi, 2
test edi, edi
mov eax, edi
jne 0x18000120e
call fcn.180001f2c
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18000331c
Capabilities:
Connect to http server
Create http request

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], r8d
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov rbp, rdx
mov dword [rax + 0x18], 0xea60
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x18000d350]
add eax, eax
xor edx, edx
lea r8d, [rax + 1]
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edi, edi
cmp rax, rdi
mov rsi, rax
je 0x1800033a3
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov rdx, rax
call qword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
mov rcx, qword [0x18000d350]
xor edx, edx
cmp eax, edi
je 0x18000339a
mov r8, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx + 8], rsi
jmp 0x1800033a3
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov dword [rsp + 0x20], 0x10000000
call qword [sym.imp.WININET.dll_InternetOpenA]
cmp rax, rdi
mov qword [rbx + 0x20], rax
je 0x180003537
lea rdx, [0x18000329c]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetSetStatusCallback]
or rsi, 0xffffffffffffffff
cmp rax, rsi
je 0x180003537
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov r8w, 0x50
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WININET.dll_InternetConnectA]
cmp rax, rdi
mov qword [rbx + 0x28], rax
jne 0x18000346f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x180003537
mov rax, qword [rbx + 0x38]
lea rdx, [rsp + 0x48]
lea ecx, [rsi + 3]
mov qword [rsp + 0x48], rax
mov rax, qword [0x18000d398]
mov r9d, 0xea60
xor r8d, r8d
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
cmove eax, esi
cmp eax, edi
jne 0x180003537
mov r8, qword [rbx + 8]
mov rcx, qword [rbx + 0x28]
mov eax, 0x84404000
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
lea rdx, [0x18000f416]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x80], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
cmp rax, rdi
mov qword [rbx + 0x30], rax
je 0x180003537
mov esi, 4
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
lea ebp, [rsi + 0x1b]
mov rcx, rax
mov dword [rsp + 0x40], esi
mov edx, ebp
call qword [sym.imp.WININET.dll_InternetQueryOptionA]
cmp eax, edi
je 0x1800034fb
mov rcx, qword [rbx + 0x30]
bts dword [rsp + 0x80], 8
lea r8, [rsp + 0x80]
mov r9d, esi
mov edx, ebp
call qword [sym.imp.WININET.dll_InternetSetOptionA]
mov rcx, qword [rbx + 0x30]
lea r8, [rsp + 0x90]
mov r9d, esi
mov edx, 6
call qword [sym.imp.WININET.dll_InternetSetOptionA]
cmp eax, edi
je 0x180003537
mov rcx, qword [rbx + 0x30]
lea r8, [rsp + 0x90]
mov r9d, esi
mov edx, 5
call qword [sym.imp.WININET.dll_InternetSetOptionA]
cmp eax, edi
jne 0x18000353f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x180003554
Capabilities:
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r15
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x38]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rdi + 0x30]
lea r9, [rsp + 0x50]
lea r8d, [rbx + 4]
lea rdx, [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetReadFile]
or r15d, 0xffffffff
test eax, eax
jne 0x1800035e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov ebx, eax
jne 0x1800035de
mov rax, qword [rdi + 0x38]
lea rdx, [rsp + 0x20]
lea ecx, [r15 + 3]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18000d398]
or r9d, 0xffffffff
xor r8d, r8d
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
mov ebx, eax
cmove ebx, r15d
test ebx, ebx
jne 0x18000371f
mov ebx, dword [rdi + 0x50]
test ebx, ebx
jne 0x18000371f
cmp dword [rsp + 0x50], 0
je 0x18000371b
lea r8, [rsp + 0x60]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x180003714
mov rcx, qword [0x18000d350]
xor edx, edx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rsi, rax
je 0x180003702
mov rcx, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x58]
mov r10, qword [rcx]
xor r9d, r9d
call qword [r10 + 0x20]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rdi + 0x30]
lea r9, [rsp + 0x50]
mov r8d, 0x1000
mov rdx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1800036b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov ebx, eax
jne 0x1800036db
mov rax, qword [rdi + 0x38]
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18000d398]
lea ecx, [r8 + 2]
or r9d, 0xffffffff
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
mov ebx, eax
cmove ebx, r15d
test ebx, ebx
jne 0x1800036db
mov ebx, dword [rdi + 0x50]
test ebx, ebx
jne 0x1800036db
mov r8d, dword [rsp + 0x50]
test r8d, r8d
je 0x1800036d9
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x180003645
xor ebx, ebx
mov rcx, qword [0x18000d350]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x180003707
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.180003040
mov ebx, eax
jmp 0x180003707
mov ebx, 8
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x18000371f
mov ebx, 8
jmp 0x18000371f
and dword [rdi + 0x58], 0
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x1800038d0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
xor r15d, r15d
xor edx, edx
mov rsi, r9
mov r13d, r8d
mov r12, rcx
mov rdi, r15
mov ebx, 8
call fcn.180005024
cmp rax, r15
mov rbp, rax
je 0x1800039bc
cmp rsi, r15
je 0x18000392d
xor edx, edx
mov rcx, rsi
call fcn.180005024
cmp rax, r15
mov rdi, rax
je 0x1800039aa
mov rcx, r12
call fcn.1800049f4
cmp rax, r15
mov rsi, rax
je 0x180003965
mov r9d, 1
mov r8d, r13d
mov rdx, r14
mov rcx, rax
call fcn.180004b84
mov rcx, qword [0x18000d350]
mov r8, rsi
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, r15d
jne 0x180003993
lea rdx, [0x18000f100]
mov r9, rdi
mov r8, rbp
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
cmp eax, 0x20
cmovg ebx, r15d
cmp rdi, r15
je 0x1800039aa
mov rcx, qword [0x18000d350]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x18000d350]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180003b3c
Capabilities:
Clear file content
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov esi, r8d
mov eax, 0x1000
xor ebx, ebx
shr esi, 1
mov r12d, r8d
mov r13, rdx
cmp esi, eax
lea r8d, [rbx + 1]
mov edx, 0xc0000000
cmova esi, eax
and qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r14, rcx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x180003c00
and qword [rsp + 0x20], rbx
mov ebp, esi
lea r9, [rsp + 0x80]
add rbp, r13
mov r8d, esi
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180003be4
and qword [rsp + 0x20], rbx
sub r12d, esi
lea r9, [rsp + 0x80]
mov r8d, r12d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180003bec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180003c08
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x180003c7c
and qword [rsp + 0x30], 0
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x180003c74
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov r8d, esi
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180003c69
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x180003c7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180003c98
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xa0
and dword [rax - 0x78], 0
mov rbp, rdx
xor edx, edx
mov rsi, rcx
lea rcx, [rax - 0x74]
lea r8d, [rdx + 0x6c]
call sub.ntdll.dll_memset
xor ebx, ebx
xor ecx, ecx
lea edx, [rbx + 2]
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, 0x750
call fcn.180004d98
test rax, rax
mov rdi, rax
je 0x180003dd5
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test rbp, rbp
je 0x180003d5a
test rax, rax
je 0x180003d0e
lea rdx, [0x18000f4d8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbp
lea ebx, [rax + rax]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rsi
add ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x18000d350]
add eax, ebx
xor edx, edx
lea r8d, [rax + rax + 0x56]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x180003dc3
mov qword [rsp + 0x28], rbp
lea rdx, [0x18000f620]
jmp 0x180003daf
test rax, rax
je 0x180003d6f
lea rdx, [0x18000f4c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rsi
lea ebx, [rax + rax]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea ecx, [rbx + rax*2 + 0x24]
lea r8d, [rcx + rcx]
mov rcx, qword [0x18000d350]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x180003dc3
mov qword [rsp + 0x28], rsi
lea rdx, [0x18000f680]
mov r9, rdi
mov r8, rsi
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [0x18000d350]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [0x18000f5e8]
test rbx, rbx
mov dword [rsp + 0x30], 0x70
mov qword [rsp + 0x40], rax
lea rax, [0x18000f608]
mov qword [rsp + 0x50], rbx
cmovne rsi, rax
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x180003e01
test rbx, rbx
je 0x180003e27
mov rcx, qword [0x18000d350]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18000438c
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
mov dword [r11 + 0x18], r8d
push rdi
push r12
push r13
sub rsp, 0x50
xor r13d, r13d
lea rax, [r11 - 0x20]
mov r9d, 0x20019
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffff80000003
mov qword [r11 - 0x48], rax
mov dword [r11 + 0x18], r13d
mov dword [r11 - 0x24], r13d
mov dword [r11 - 0x28], r13d
mov r12, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r13d
mov ebx, eax
jne 0x180004527
mov rcx, qword [0x18000d350]
xor edx, edx
mov r8d, 0x104
lea ebx, [r13 + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov rdi, rax
je 0x18000451c
mov rbp, qword [rsp + 0x90]
mov esi, 0x104
mov edx, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
lea r9, [rsp + 0x40]
mov r8, rdi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x40], 0x104
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0xea
mov ebx, eax
jne 0x1800044b2
cmp dword [rsp + 0x40], 0x104
jbe 0x180004471
add dword [rsp + 0x80], 1
mov ebx, r13d
jmp 0x1800044e5
cmp dword [rsp + 0x44], esi
jbe 0x18000450a
mov rcx, qword [0x18000d350]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [rsp + 0x44]
mov rcx, qword [0x18000d350]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov r12, rax
jne 0x18000446c
mov ebx, 8
jmp 0x18000450a
cmp eax, r13d
jne 0x180004500
mov r9d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x80]
mov r8, r12
mov rdx, rdi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.180003e48
cmp eax, r13d
mov ebx, eax
jne 0x180004500
mov rcx, qword [0x18000d398]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x18000450a
jmp 0x180004417
cmp ebx, 0x103
cmove ebx, r13d
mov rcx, qword [0x18000d350]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x180004974
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
test rcx, rcx
mov rdi, rcx
je 0x1800049e0
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
mov esi, eax
je 0x1800049e0
mov rcx, qword [0x18000d350]
lea r8d, [rax + rax]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x1800049e0
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1800049e0
mov rcx, qword [0x18000d350]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180004a88
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor edi, edi
mov rbp, r8
mov r12, rdx
and qword [rax - 0x28], rdi
mov dword [rax - 0x30], 0x80
lea r8d, [rdi + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rax - 0x38], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x180004b3d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov ebx, eax
jne 0x180004ae8
mov ebx, 0xe8
jmp 0x180004b45
mov rcx, qword [0x18000d350]
lea r8d, [rbx + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x180004b3d
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180004b3d
cmp ebx, dword [rsp + 0x78]
je 0x180004b2e
mov ebx, 0x1e
jmp 0x180004b45
mov byte [rbx + rdi], 0
mov qword [r12], rdi
mov dword [rbp], ebx
xor ebx, ebx
jmp 0x180004b45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rsi, 0xffffffffffffffff
je 0x180004b54
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x180004b6f
test ebx, ebx
je 0x180004b6f
mov rcx, qword [0x18000d350]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret