joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4840
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400c487a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400c487f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400c48c8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400c48c8
dec r8
sub rdx, 1
jne 0x1400c48ae
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x180a74058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180a741df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180a74089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180a7406f
add dl, dl
jne 0x180a74096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180a740f6
xor eax, eax
add dl, dl
jne 0x180a740a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180a741ad
add dl, dl
jne 0x180a740b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a740c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a740d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a740dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180a740ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180a7407e
mov eax, 1
add dl, dl
jne 0x180a74106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a74113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180a740fb
sub eax, ebx
mov ebx, 1
jne 0x180a7414c
mov ecx, 1
add dl, dl
jne 0x180a7412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180a7413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180a74123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180a7407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180a74168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180a74175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180a7415d
cmp eax, 0x7d00
jae 0x180a7419b
cmp eax, 0x500
jb 0x180a74196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180a7407e
cmp eax, 0x7f
ja 0x180a7419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180a7407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180a741d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180a7407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140009008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140009008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140009008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret

Function at 0x1400018f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001942
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001942
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001942
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001942
cmp dword [rcx + 0x84], 0xe
jbe 0x140001942
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001944
xor al, al
add rsp, 0x28
ret
Function at 0x140004d70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r15d, 0x1398
mov eax, dword [r15 + rsi]
mov r12d, 0x13b0
test al, 1
jne 0x140004e1d
or eax, 1
mov dword [r15 + rsi], eax
mov r14d, r12d
add r14, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [r14 + 0x1384], 0xffffffff
mov dword [r14 + 4], eax
lea ecx, [rbp + 1]
lea r8, [r14 + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140004df0
mov dword [r14], 0x270
mov eax, dword [r15 + rsi]
mov r14d, 0x2740
test al, 2
jne 0x140004e3b
or eax, 2
mov dword [r15 + rsi], eax
mov qword [r14 + rsi], rbp
mov qword [r14 + rsi + 8], 0x3d
mov qword [rbx], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
cmp rdi, 0xf
je 0x140004e73
jbe 0x140004e6e
mov rdx, rdi
mov rcx, rbx
call fcn.140006d70
mov qword [rbx + 0x10], rbp
jmp 0x140004e73
test rdi, rdi
je 0x140004edc
mov ebp, r12d
add rbp, rsi
mov eax, r14d
add rsi, rax
lea r14, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
nop word [rax + rax]
dec rdi
mov rdx, rbp
mov rcx, rsi
call fcn.1400062e0
movzx r9d, byte [rax + r14]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140004ecf
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140004ec4
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140004ed7
mov rcx, rbx
call fcn.1400020f0
test rdi, rdi
jne 0x140004e90
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140004f00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r15d, 0x2738
mov eax, dword [r15 + rsi]
mov r12d, 0x10
test al, 1
jne 0x140004fad
or eax, 1
mov dword [r15 + rsi], eax
mov r14d, r12d
add r14, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [r14 + 0x1384], 0xffffffff
mov dword [r14 + 4], eax
lea ecx, [rbp + 1]
lea r8, [r14 + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140004f80
mov dword [r14], 0x270
mov eax, dword [r15 + rsi]
mov r14d, 0x13a0
test al, 2
jne 0x140004fcb
or eax, 2
mov dword [r15 + rsi], eax
mov qword [r14 + rsi], rbp
mov qword [r14 + rsi + 8], 9
mov qword [rbx], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
cmp rdi, 0xf
je 0x140005003
jbe 0x140004ffe
mov rdx, rdi
mov rcx, rbx
call fcn.140006d70
mov qword [rbx + 0x10], rbp
jmp 0x140005003
test rdi, rdi
je 0x14000506c
mov ebp, r12d
add rbp, rsi
mov eax, r14d
add rsi, rax
lea r14, str.0123456789
nop word [rax + rax]
dec rdi
mov rdx, rbp
mov rcx, rsi
call fcn.1400062e0
movzx r9d, byte [rax + r14]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14000505f
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140005054
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140005067
mov rcx, rbx
call fcn.1400020f0
test rdi, rdi
jne 0x140005020
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400072c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140007321
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1400072e0
mov ecx, dword [r10]
jmp 0x14000740a
cmp ecx, 0x4e0
jb 0x14000740a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140007340
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140007390
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140007460
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x140012010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov r14, rdx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007583
mov qword [rsp + 0x48], rdi
mov rax, 0xffffffffffffffff
xor edi, edi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x1400074c0
test rax, rax
je 0x14000755c
mov qword [rsp + 0x88], rsi
mov rcx, rdi
mov qword [rsp + 0x40], r15
lea r15, [0x140012078]
nop dword [rax]
lea rsi, [rbx + rcx*2]
mov edx, 0x80
movzx ecx, word [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswctype]
test eax, eax
je 0x14000752d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [r15 + rcx*2], 0
jne 0x140007515
xor edx, edx
div rcx
movzx eax, word [r15 + rdx*2]
mov word [rsi], ax
inc edi
mov rax, 0xffffffffffffffff
mov ecx, edi
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140007540
cmp rcx, rax
jb 0x1400074f0
mov r15, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov eax, dword [rsp + 0x30]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140007b10
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
Function at 0x1400075a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
mov eax, 0x2050
call fcn.140008a40
sub rsp, rax
mov rax, qword [0x140012010]
xor rax, rsp
mov qword [rsp + 0x2040], rax
lea rax, [rsp + 0x30]
xor ebx, ebx
mov r9d, 0xf003f
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000771d
mov qword [rsp + 0x2060], rsi
lea rcx, [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x1ffe
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x1ffe
mov qword [rsp + 0x28], rax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000770c
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x1400076e5
mov qword [rsp + 0x2068], rdi
mov qword [rsp + 0x2070], r14
lea r14, [0x140012078]
nop dword [rax]
nop word [rax + rax]
mov eax, ebx
lea rdi, [rsp + 0x40]
movzx ecx, word [rdi + rax*2]
lea rdi, [rdi + rax*2]
mov edx, 0x80
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswctype]
test eax, eax
je 0x1400076cb
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x1400076b0
dec rcx
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
mov eax, dword [rsp + 0x38]
inc ebx
cmp ebx, eax
jb 0x140007680
mov r14, qword [rsp + 0x2070]
mov rdi, qword [rsp + 0x2068]
mov dword [rsp + 0x28], eax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x40]
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2060]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140007b10
add rsp, 0x2050
pop rbx
ret
Function at 0x140007970
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x6a0
mov rax, qword [0x140012010]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x480]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
lea rdx, str._ws
lea rcx, [rsp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x4c]
mov r8, rdi
lea rdx, str._ws_ws
lea rcx, [rsp + 0x270]
call qword [sym.imp.USER32.dll_wsprintfW]
movzx ecx, word [rsp + 0x4c]
movzx eax, word [rsp + 0x4e]
cmp cx, 0x2e
jne 0x140007a49
test ax, ax
je 0x140007a83
cmp cx, cx
jne 0x140007a49
cmp ax, cx
jne 0x140007a49
cmp word [rsp + 0x50], 0
je 0x140007a83
test byte [rsp + 0x20], 0x10
lea rdx, str.desktop.ini
je 0x140007a66
lea rcx, [rsp + 0x270]
call fcn.140007970
jmp 0x140007a83
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
je 0x140007a83
lea rcx, [rsp + 0x270]
call fcn.140007740
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400079f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.140007b10
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x6a0
pop rdi
ret
Function at 0x140001190
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
sub rsp, 0x30
mov rbp, r8
movsxd rbx, ecx
call fcn.140001130
cmp ebx, 0x3e7
ja 0x14000123c
lea rdx, [0x140018050]
mov rax, rbx
mov qword [rsp + 0x40], rsi
add rax, rax
mov ecx, 0x58
mov qword [rsp + 0x50], rdi
lea rdi, [rdx + rax*8]
lea rsi, [rdx + rax*8]
lea rax, [rsp + 0x48]
mov word [rdi], cx
mov qword [rsp + 0x28], rax
lea r8, [0x140002250]
xor ebx, ebx
xor ecx, ecx
mov r9, rbp
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.MSVCR120.dll__beginthreadex]
mov qword [rsi + 8], rax
cmp qword [rsp + 0x48], rbx
jne 0x140001225
mov eax, 0xffffffff
mov qword [rsi + 8], rax
mov eax, 0x20
mov word [rdi], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
mov eax, 0x16
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret

Function at 0x1400016d0
Capabilities:
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x830
mov rax, qword [0x140017008]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov r14, rdx
mov ebp, ecx
lea rdx, str.FAILLEVEL
lea rcx, [r8 + 0x108]
mov rdi, r9
mov rbx, r8
call qword [sym.imp.MSVCR120.dll_wcsstr]
test rax, rax
jne 0x1400017a0
lea rdx, str._s:_rc_d
lea rcx, [rsp + 0x20]
mov r9d, ebp
mov r8, r14
call fcn.140001440
lea rdx, [rsp + 0x20]
xor ecx, ecx
call fcn.14000d400
lea rcx, [rsp + 0x20]
call qword [sym.imp.LIBSAPUCUM.dll_printfU16]
lea r8, [rbx + 8]
lea r9, [rbx + 0x108]
lea rdx, str._s:__s
lea rcx, [rsp + 0x20]
call fcn.140001440
lea rdx, [rsp + 0x20]
xor ecx, ecx
call fcn.14000d400
lea rcx, [rsp + 0x20]
call qword [sym.imp.LIBSAPUCUM.dll_printfU16]
test rdi, rdi
je 0x14000178a
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.SAPNWRFC.dll_RfcCloseConnection]
cmp byte [rsp + 0x880], 1
jne 0x1400017a0
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.14000fad0
add rsp, 0x830
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001970
Capabilities:
Query environment variable

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa80
mov rax, qword [0x140017008]
xor rax, rsp
mov qword [rsp + 0xa70], rax
lea rcx, str.TRILLDIRADDR
mov esi, r9d
mov edi, r8d
mov rbx, rdx
call qword [sym.imp.MSVCR120.dll_getenv]
lea rcx, str.TRILLDIRPORT
mov qword [0x140017b80], rax
call qword [sym.imp.MSVCR120.dll_getenv]
mov dword [rsp + 0x34], 0
mov qword [0x140017ca8], rax
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400019d0
add eax, 2
or rdx, 0xffffffffffffffff
mov dword [rsp + 0x30], eax
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x1400019e5
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x850]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SAPNWRFC.dll_RfcSAPUCToUTF8]
test rbx, rbx
je 0x140001a5b
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x140001a22
test rax, rax
je 0x140001a5b
lea r8, [rsp + 0x850]
lea rdx, str.TRILLCONFIG_s
lea rcx, [rsp + 0x960]
call qword [sym.imp.MSVCR120.dll_sprintf]
lea rcx, [rsp + 0x960]
call qword [sym.imp.MSVCR120.dll__putenv]
lea rcx, str.TRILLCONFIG
call qword [sym.imp.MSVCR120.dll_getenv]
test edi, edi
lea r8, str.Unicode
mov qword [0x140017978], rax
mov eax, dword [0x140017030]
lea rdx, str.Initializing__s_SAP_Client_n
cmovne eax, edi
test esi, esi
lea rcx, [rsp + 0x720]
mov dword [0x140017030], eax
mov eax, dword [0x140017034]
cmovne eax, esi
mov dword [0x140017034], eax
call qword [sym.imp.MSVCR120.dll_sprintf]
mov rax, qword [0x140017ca8]
mov r9, qword [0x140017b80]
mov r8, qword [0x140017978]
lea rbx, [0x140017ba0]
lea rdx, str.CONFIG____s_nDIRADDR___s_nDIRPORT___s_n
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR120.dll_sprintf]
lea rcx, [rsp + 0x720]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001af0
xor edx, edx
nop dword [rax]
movzx eax, byte [rbx + rdx]
lea rdx, [rdx + 1]
mov byte [rcx + rdx - 1], al
test al, al
jne 0x140001b00
mov r9d, dword [0x140017034]
mov r8d, dword [0x140017030]
lea rdx, str.Retry_count___d_nRetry_wait___d_seconds
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_sprintf]
lea rcx, [rsp + 0x720]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001b40
xor edx, edx
nop dword [rax]
movzx eax, byte [rbx + rdx]
lea rdx, [rdx + 1]
mov byte [rcx + rdx - 1], al
test al, al
jne 0x140001b50
lea rdx, [rsp + 0x720]
xor ecx, ecx
call fcn.14000d370
mov rcx, qword [0x140017978]
test rcx, rcx
je 0x140001b92
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140001b80
test rax, rax
je 0x140001b92
xor eax, eax
jmp 0x140001ba6
lea rdx, str.Unable_to_determine_configuration_file.
mov ecx, 2
call fcn.14000d370
or eax, 0xffffffff
mov rcx, qword [rsp + 0xa70]
xor rcx, rsp
call fcn.14000fad0
add rsp, 0xa80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140009db0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140009e24
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009e46
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009e46
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x140009e46
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14000a1ce
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140009db0
cmp byte [0x14001bf08], 0
jne 0x14000a219
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a209
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14001bf08], 1
mov qword [0x14001bf10], rax
jmp 0x14000a220
mov rax, qword [0x14001bf10]
mov byte [0x14001bf08], 1
jmp 0x14000a220
mov rax, qword [0x14001bf10]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000a23f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]