joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052f98
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x10020
call fcn.140039ca0
sub rsp, rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x7fff
call fcn.140006458
lea rcx, [rsp + 0x20]
call fcn.1400292f8
xor esi, esi
mov edi, 0x5c
test rax, rax
je 0x140052fe5
cmp word [rsp + rax*2 + 0x1e], di
jne 0x140052fe5
mov word [rsp + rax*2 + 0x1e], si
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140053070
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140053015
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14005301a
mov al, 1
jmp 0x140053076
cmp eax, 3
jne 0x140053074
lea rcx, [rsp + 0x20]
call fcn.140054e14
mov edx, edi
mov rcx, rax
mov rbx, rax
call fcn.14002ae18
mov rcx, rbx
test rax, rax
jne 0x140053040
call fcn.140029210
jmp 0x140053074
mov word [rax], si
call fcn.140052f98
mov rcx, rbx
mov dil, al
call fcn.140029210
test dil, dil
je 0x14005306b
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne dil
mov al, dil
jmp 0x140053076
test al, 0x10
jne 0x140053011
xor al, al
lea r11, [rsp + 0x10020]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14005308c
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x10380]
mov eax, 0x10480
call fcn.140039ca0
sub rsp, rax
lea r8, [rbp + 0x380]
xor ebx, ebx
mov edx, 0x7fff
mov r14b, bl
call fcn.140053e14
lea rcx, [rbp + 0x380]
call fcn.140054388
test al, al
je 0x1400530e8
lea rdx, [0x1400c7fe8]
lea rcx, [rbp + 0x380]
call fcn.140029314
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x103a8]
lea rcx, [rbp + 0x380]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
call fcn.14002a5bc
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov sil, 1
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140053198
cmp sil, 1
jne 0x140053198
test byte [rsp + 0x30], 0x10
jne 0x140053181
lea rdx, [rbp + 0x103a8]
lea rcx, [rbp + 0x380]
mov r14b, sil
call fcn.140029340
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x380]
call fcn.140029314
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x380]
call fcn.140029314
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x14005319b
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140053128
mov sil, bl
jmp 0x140053128
mov bl, r14b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x10480]
mov al, bl
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400531c0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x690
mov r14, rdx
xor edx, edx
mov rbp, rcx
lea ecx, [rdx + 2]
mov rbx, r8
mov dword [rsp + 0x30], 0x238
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rcx, rbp
mov byte [rbx], 0
call fcn.140053fe0
mov esi, eax
jmp 0x140053293
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140053298
lea rax, [rsp + 0x480]
lea r9, [rsp + 0x270]
lea rcx, [rsp + 0x5c]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.14002a5bc
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x270]
call fcn.140029314
lea rcx, [rsp + 0x270]
mov rdx, rbp
call fcn.140029694
test eax, eax
jne 0x140053281
mov eax, dword [rsp + 0x38]
mov dword [r14], eax
jmp 0x140053290
test esi, esi
je 0x140053293
mov ecx, dword [rsp + 0x38]
cmp esi, ecx
jne 0x140053293
mov dword [r14], ecx
mov byte [rbx], 1
cmp byte [rbx], 0
je 0x140053218
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x690]
mov al, 1
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x1400532c4
Capabilities:
Get storage device properties

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x80
and qword [rax - 0x58], 0
and dword [rdx], 0
mov rdi, rdx
mov edx, 0x80
xor r9d, r9d
lea r8d, [rdx - 0x7d]
mov dword [rax - 0x60], edx
mov dword [rax - 0x68], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140053308
xor al, al
jmp 0x140053381
and dword [rsp + 0x40], 0
and dword [rsp + 0x44], 0
xor eax, eax
lea ebx, [rax + 0x28]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, ebx
mov dword [rsp + 0x48], eax
call fcn.140029370
and qword [rsp + 0x38], 0
and dword [rsp + 0x98], 0
lea rax, [rsp + 0x98]
lea r9d, [rbx - 0x1c]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x2d1400
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140053304
mov eax, dword [rsp + 0x6c]
mov dword [rdi], eax
mov al, 1
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140053398
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400dee40]
xor edi, edi
cmp byte [rax + 0x39], dil
jne 0x1400533c0
mov eax, 0x80004005
jmp 0x14005345a
mov edx, 0x80
mov qword [rsp + 0x30], rdi
xor r9d, r9d
lea r8d, [rdx - 0x7d]
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400533b6
xor eax, eax
mov qword [rsp + 0x38], rdi
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x50]
mov edx, 0x2d1400
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], r9d
mov rcx, rsi
mov qword [rsp + 0x50], 7
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400533b6
cmp byte [rsp + 0x48], dil
setne dil
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140053bfc
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rbp, rdx
lea rdx, [rax - 0x38]
mov rsi, r8
mov r15, rcx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
xor ebx, ebx
mov edi, eax
test eax, eax
je 0x140053dfa
mov rcx, rdi
call fcn.140029168
mov r8d, edi
xor edx, edx
mov r9, rax
mov rcx, r15
mov r14, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov rcx, rsi
call fcn.1400292f8
lea rcx, [rax + 0x1a]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140029168
lea r15, [0x1400b1d58]
mov rdx, r15
mov rcx, rax
mov rdi, rax
call fcn.140029340
mov rdx, r15
mov rcx, rsi
call fcn.140029dd8
test eax, eax
je 0x140053d2f
lea rdx, str.StringFileInfo_
mov rcx, rdi
call fcn.140029314
mov rdx, r15
mov rcx, rsi
call fcn.14002a258
test rax, rax
jne 0x140053d24
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x40]
lea rdx, str.VarFileInfoTranslation
mov rcx, r14
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140053d0a
mov rax, qword [rsp + 0x40]
lea rdx, [rdi + 0x20]
mov r8d, 4
mov r11d, dword [rax]
mov ecx, r11d
call fcn.1400098c8
shr r11, 0x10
lea rdx, [rdi + 0x28]
mov rcx, r11
call fcn.1400098c8
jmp 0x140053d19
lea rdx, str.04090000
mov rcx, rdi
call fcn.140029314
mov rdx, r15
mov rcx, rdi
call fcn.140029314
mov rdx, rsi
mov rcx, rdi
call fcn.140029314
lea rdx, str.DefaultLangCodepage
mov rcx, rsi
call fcn.140029694
test eax, eax
jne 0x140053d6d
lea rdx, [rdi + 0x20]
lea r8d, [rax + 8]
mov rcx, rbp
call fcn.14002ad0c
mov rcx, r14
mov word [rbp + 0x10], bx
call fcn.140029210
mov rcx, rdi
call fcn.140029210
mov al, 1
jmp 0x140053dfa
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x38]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140053de8
mov rdx, r15
mov rcx, rsi
call fcn.140029dd8
test eax, eax
jne 0x140053dcc
mov rax, qword [rsp + 0x38]
lea rdx, str._u._u._u._u
mov ecx, dword [rax + 0xc]
mov r8d, dword [rax + 8]
movzx eax, cx
shr ecx, 0x10
movzx r9d, r8w
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, rbp
shr r8d, 0x10
call fcn.140029f24
jmp 0x140053de6
mov rdx, qword [rsp + 0x38]
mov r8d, 0x200
mov rcx, rbp
call fcn.14002ad0c
mov word [rbp + 0x400], bx
mov bl, 1
mov rcx, r14
call fcn.140029210
mov rcx, rdi
call fcn.140029210
mov al, bl
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140053e78
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2c0
mov rdi, rdx
movsxd rbx, ecx
lea rdx, [rsp + 0x120]
mov ecx, 0x101
call qword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x140053f56
lea rcx, [rsp + 0x20]
mov edx, 0x100
call qword [sym.imp.WSOCK32.dll_gethostname]
lea rcx, [rsp + 0x20]
call qword [sym.imp.WSOCK32.dll_gethostbyname]
test rax, rax
je 0x140053f56
mov r9, qword [rax + 0x18]
xor ecx, ecx
cmp qword [r9], rcx
je 0x140053ee4
mov rax, r9
lea rax, [rax + 8]
inc ecx
cmp qword [rax], 0
jne 0x140053ed8
cmp ebx, ecx
jle 0x140053ef9
lea rdx, str.0.0.0.0
mov rcx, rdi
call fcn.140029340
jmp 0x140053f4e
mov rdx, qword [r9 + rbx*8 - 8]
lea rcx, [rsp + 0x2e0]
mov r8d, 4
call fcn.140028c50
mov ecx, dword [rsp + 0x2e0]
call qword [sym.imp.WSOCK32.dll_inet_ntoa]
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.14002af80
lea rcx, [rsp + 0x20]
or edx, 0xffffffff
call fcn.140054f70
mov rcx, rdi
mov rdx, rax
mov rbx, rax
call fcn.140029340
mov rcx, rbx
call fcn.140029210
call qword [sym.imp.WSOCK32.dll_WSACleanup]
jmp 0x140053f65
lea rdx, [0x1400b1af8]
mov rcx, rdi
call fcn.140029340
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2c0
pop rdi
ret

Function at 0x140054034
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
lea rax, [rsp + 0x30]
mov rbx, rdx
mov edx, ecx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400084d0
add rsp, 0x240
pop rbx
ret

Function at 0x140054260
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
lea rax, [rbp + 0x20]
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea r8d, [rbx + 0x20]
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rbp + 0x18], ebx
mov word [rbp + 0x1c], 0x500
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp + 0x10], eax
test eax, eax
je 0x1400542da
mov rdx, qword [rbp + 0x20]
lea r8, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and dword [rbp + 0x10], ecx
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp + 0x10]
mov rbx, qword [rsp + 0x88]
cmp eax, 1
sete al
add rsp, 0x60
pop rbp
ret

Function at 0x140054388
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005439f
test al, 0x10
je 0x14005439f
mov al, 1
jmp 0x1400543a1
xor al, al
add rsp, 0x28
ret
Function at 0x1400543e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov ebx, dword [rsp + 0x80]
xor edi, edi
mov esi, r9d
mov rbp, r8
mov r14, rdx
mov r15, rcx
mov byte [0x1400e00a1], dil
test ebx, ebx
je 0x140054456
mov byte [0x1400e00a2], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x80]
lea r8, [0x140054928]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x34], ebx
call fcn.14002aa5c
mov rdi, rax
mov r9d, esi
mov r8, rbp
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, eax
test rdi, rdi
je 0x14005448b
or edx, 0xffffffff
mov rcx, rdi
mov byte [0x1400e00a2], 0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
or eax, 0xffffffff
cmp byte [0x1400e00a1], 1
cmove ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400546c4
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x20390]
mov eax, 0x20490
call fcn.140039ca0
sub rsp, rax
mov dil, r8b
mov rbx, rdx
lea r8, [rbp + 0x10390]
mov edx, 0x7fff
call fcn.140053e14
lea r8, [rbp + 0x390]
mov edx, 0x7fff
mov rcx, rbx
call fcn.140053e14
lea rcx, [rbp + 0x10390]
call fcn.140054388
xor ebx, ebx
test al, al
jne 0x140054728
xor al, al
jmp 0x1400548ba
lea rcx, [rbp + 0x390]
call fcn.140054388
test al, al
je 0x1400547ee
test dil, dil
je 0x140054721
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x10390]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea rcx, [rbp + 0x10390]
test eax, eax
jne 0x140054795
lea rdx, [rbp + 0x390]
call fcn.140029dd8
test eax, eax
je 0x14005478e
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x10390]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
jmp 0x1400548ba
mov al, 1
jmp 0x1400548ba
lea rax, [rsp + 0x70]
lea r9, [rbp + 0x180]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.14002a5bc
lea rdx, [0x1400b1d58]
lea rcx, [rbp + 0x390]
call fcn.140029314
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x390]
call fcn.140029314
cmp word [rsp + 0x70], bx
je 0x1400547ee
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x390]
call fcn.140029314
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x10390]
call fcn.1400542f0
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x10390]
test al, al
je 0x140054838
mov r8b, 1
call fcn.140052b9c
test al, al
je 0x140054721
lea rcx, [rbp + 0x10390]
mov dl, 1
call fcn.140054b0c
test al, al
jmp 0x140054786
call fcn.140029dd8
test eax, eax
je 0x140054721
lea rcx, [rbp + 0x10390]
call fcn.1400292f8
lea rcx, [rbp + 0x390]
mov word [rbp + rax*2 + 0x10392], bx
call fcn.1400292f8
lea rcx, [rsp + 0x30]
mov word [rbp + rax*2 + 0x392], bx
lea rax, [rbp + 0x10390]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x390]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x48], rax
mov eax, 0x614
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], 1
mov word [rsp + 0x50], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
lea r11, [rsp + 0x20490]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140054b0c
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xff60]
mov eax, 0x10060
call fcn.140039ca0
sub rsp, rax
mov bl, dl
lea r8, [rsp + 0x60]
mov edx, 0x7fff
call fcn.140053e14
lea rcx, [rsp + 0x60]
call fcn.140054388
xor edi, edi
test al, al
je 0x140054bb1
lea rcx, [rsp + 0x60]
test bl, bl
jne 0x140054b63
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x140054bb1
call fcn.1400292f8
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rdi
mov word [rsp + rax*2 + 0x62], di
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x30], rax
mov eax, 0x614
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
lea r11, [rsp + 0x10060]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140054bc8
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov esi, edx
mov edi, ecx
lea rdx, str.SeShutdownPrivilege
lea rcx, [rsp + 0x30]
call fcn.140052a70
lea rcx, [rsp + 0x30]
call fcn.140045178
xor ebx, ebx
test al, al
je 0x140054c57
cmp edi, 0x20
je 0x140054c46
cmp edi, 0x40
je 0x140054c4b
test dil, 0xb
jne 0x140054c18
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x140054c55
test dil, 0x14
mov r9d, ebx
mov eax, 1
cmovne r9d, eax
test dil, 2
mov dword [rsp + 0x28], esi
cmovne ebx, eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
jmp 0x140054c55
mov ebx, 1
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.14004486c
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140054c74
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
test ecx, ecx
js 0x140054cf5
push rbx
sub rsp, 0x20
mov ebx, ecx
test ecx, ecx
je 0x140054cea
cmp ecx, 0xf
jae 0x140054ce8
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140054ce8
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x38]
xorps xmm1, xmm1
xorps xmm0, xmm0
sub rax, qword [rsp + 0x40]
cvtsi2sd xmm0, qword [rsp + 0x48]
cvtsi2sd xmm1, rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x1400c6db8]
cvttsd2si rax, xmm1
cmp eax, ebx
jb 0x140054ca2
jmp 0x140054cf0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x20
pop rbx
ret
Function at 0x140054ee8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
xor r9d, r9d
xor r8d, r8d
mov rbx, rcx
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea edx, [r9 + 0x10]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 0x1f4
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
jne 0x140054f6a
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
pop rbx
ret

Function at 0x1400562a8
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x60
mov eax, dword [rcx]
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov rbx, r9
mov dword [rsp + 0x40], reloc.OLEAUT32.dll_SafeArrayGetElement
test al, 0x10
je 0x1400562f6
mov ecx, r8d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140056383
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call fcn.1400560bc
jmp 0x1400563ac
test edx, eax
je 0x14005632c
mov rax, qword [r9]
test rax, rax
jne 0x1400563af
mov rcx, qword [rsp + 0x90]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x140056389
or rax, 0xffffffffffffffff
jmp 0x1400563af
mov ecx, r8d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
jbe 0x1400562e0
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x40]
lea rcx, [0x1400c8150]
mov edx, 0x40000000
mov r8d, 2
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x140056389
and qword [rbx], 0
jmp 0x1400563ac
mov rcx, qword [rbx]
lea rdx, [rsp + 0x70]
mov r8d, 1
call fcn.1400560bc
mov rcx, rbx
call fcn.140056038
mov rax, qword [rsp + 0x70]
mov qword [rbx], rax
mov rax, qword [rbx]
add rsp, 0x60
pop rbx
ret
Function at 0x1400563b8
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x60
mov eax, dword [rcx]
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov rbx, r9
mov dword [rsp + 0x40], reloc.OLEAUT32.dll_SafeArrayGetElement
test al, 0x10
je 0x140056408
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140056497
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call fcn.1400560bc
jmp 0x1400564c0
test al, 1
je 0x14005643e
mov rax, qword [r9]
test rax, rax
jne 0x1400564c3
mov rdx, qword [rsp + 0x90]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14005649d
or rax, 0xffffffffffffffff
jmp 0x1400564c3
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, 1
lea rcx, [rax - 1]
mov qword [rbx], rax
cmp rcx, 0xfffffffffffffffd
jbe 0x1400563f8
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x40]
lea rcx, [0x1400c8150]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x14005649d
and qword [rbx], 0
jmp 0x1400564c0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x70]
mov r8d, 1
call fcn.1400560bc
mov rcx, rbx
call fcn.140056038
mov rax, qword [rsp + 0x70]
mov qword [rbx], rax
mov rax, qword [rbx]
add rsp, 0x60
pop rbx
ret

Function at 0x1400565f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x58], 0
call fcn.140056658
test al, al
je 0x140056632
test rdx, rdx
je 0x140056632
test r8, r8
je 0x140056632
and qword [rsp + 0x20], 0
lea rbx, [rcx + 0x28]
lea r9, [rsp + 0x58]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140056632
mov rcx, rbx
call fcn.140056038
mov eax, dword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret

Function at 0x1400568c8
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x58], 0
mov rbx, rcx
jne 0x1400568ff
lea rax, [rsp + 0x40]
mov r9, rcx
lea r8, [0x1400568b8]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x58], rax
add rsp, 0x30
pop rbx
ret

Function at 0x140056908
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + 0x58]
mov rdi, rcx
cmp qword [rsi], 0
je 0x140056970
mov eax, dword [rcx + 0x60]
mov ebp, 0x1f6
xchg dword [rcx + 0x60], eax
cmp eax, ebp
je 0x140056970
add rcx, 0x28
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsi]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call fcn.140056038
xchg dword [rdi + 0x60], ebp
lea rcx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret