joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005c0a0
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rdx
movabs rax, 0x79baa6bb6398b6f7
mov rbx, r8
movzx r9d, cx
shr ecx, 0x10
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0xc
imul rax, rax, 0x15b0
sub r8, rax
test r10, r10
jne 0x14005c0e8
lea eax, [r10 + 1]
mov rbx, qword [rsp + 8]
ret
test rbx, rbx
je 0x14005c1bc
xor edx, edx
cmp r8, 7
jbe 0x14005c16a
lea r11d, [rdx + 7]
nop dword [rax]
movzx eax, byte [r10]
add r11d, 8
add edx, 8
add r9d, eax
movzx eax, byte [r10 + 1]
add r10, 8
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 1]
add ecx, r9d
add r9d, eax
mov eax, r11d
add ecx, r9d
cmp rax, r8
jb 0x14005c100
mov eax, edx
cmp rax, r8
jae 0x14005c187
movzx eax, byte [r10]
inc edx
inc r10
add r9d, eax
mov eax, edx
add ecx, r9d
cmp rax, r8
jb 0x14005c171
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
sub rbx, r8
mov r8d, 0x15b0
jne 0x14005c0f1
mov rbx, qword [rsp + 8]
shl ecx, 0x10
lea eax, [r9 + rcx]
ret

Function at 0x14005c1d0
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
mov r10, rdx
test rdx, rdx
jne 0x14005c1de
xor eax, eax
ret
or eax, 0xffffffff
test r8, r8
je 0x14005c223
lea r11, [0x1402a1190]
nop dword [rax]
movzx r8d, byte [r10]
mov ecx, eax
shr eax, 4
xor rcx, r8
shr r8, 4
lea r10, [r10 + 1]
and ecx, 0xf
mov edx, dword [r11 + rcx*4]
xor edx, eax
mov eax, edx
shr edx, 4
and eax, 0xf
xor rax, r8
mov eax, dword [r11 + rax*4]
xor eax, edx
dec r9
jne 0x14005c1f0
not eax
ret
Function at 0x140060990
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x288
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp qword [rdx + 0x18], 8
mov rbx, rcx
jb 0x1400609ba
mov rdx, qword [rdx]
xor r14d, r14d
lea rax, [rsp + 0x160]
mov r8, rdx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1400609f8
xor al, al
jmp 0x140060b2c
cmp qword [rbx + 0x18], 8
jb 0x140060a04
mov rcx, qword [rbx]
jmp 0x140060a07
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rcx
xor ecx, ecx
or r9d, 0xffffffff
mov r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1400609f1
cmp qword [rbx + 0x18], 8
mov qword [rsp + 0x280], rdi
jb 0x140060a50
mov rbx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
mov dword [rsp + 0x28], MsiSetExternalUIW
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140060a8a
xor al, al
jmp 0x140060b24
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x2b0], rbp
mov qword [rsp + 0x2b8], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov esi, eax
call fcn.1400680c4
lea r9, [rsp + 0x40]
mov r8d, esi
mov rcx, rdi
mov rdx, rax
mov dword [rsp + 0x40], r14d
mov rbx, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140060b0a
cmp esi, dword [rsp + 0x40]
jne 0x140060b0a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x160]
mov r9d, esi
mov r8, rbx
call fcn.1400607d0
mov rcx, rbx
test eax, eax
je 0x140060b0d
call fcn.1400680cc
mov al, 1
jmp 0x140060b14
mov rcx, rbx
call fcn.1400680cc
xor al, al
mov rsi, qword [rsp + 0x2b8]
mov rbp, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401f2f70
add rsp, 0x288
pop r14
pop rbx
ret
Function at 0x140061f90
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
lea rcx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x140061fdf
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x140061fdf
mov r9, qword [rsp + 0x48]
lea edx, [rbx + 3]
jmp 0x140061fe9
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.Glority_Message_Client_1.0
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rcx, qword [rsp + 0x38]
mov rbx, rax
test rcx, rcx
je 0x14006200d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14006201d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14006202d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401f2f70
add rsp, 0x60
pop rbx
ret

Function at 0x1400621e0
Capabilities:
Prepare http request

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, r9
mov r15, r8
mov r14d, edx
mov r12, rcx
xor bl, bl
call fcn.140061f90
mov rdi, rax
test rax, rax
je 0x1400622c3
mov rdx, qword [0x140311f58]
mov r8d, 0x50
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x60], rsi
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rsi, rax
test rax, rax
je 0x1400622b5
mov dword [rsp + 0x30], 0x100
xor r9d, r9d
mov r8, r15
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbp, rax
test rax, rax
je 0x1400622ac
mov qword [rsp + 0x30], 0
lea rdx, str.Content_Type:application_xml
mov r9, r12
mov r8d, MsiEnumClientsA
mov rcx, rax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov rcx, rbp
test eax, eax
setne bl
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
movzx eax, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x1400622e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rbp, rdx
cmp qword [rcx + 0x18], 8
jb 0x14006231f
mov rcx, qword [rcx]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], MsiSetExternalUIW
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r15 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140062359
xor al, al
jmp 0x140062458
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov ecx, eax
call fcn.1400680c4
mov rdi, rax
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
mov r8d, reloc.OLEAUT32.dll_SafeArrayDestroy
lea rdx, str._v1_reportError
lea rcx, [rsp + 0x50]
call fcn.1400267e0
nop
mov r8d, 7
lea rdx, str._token
lea rcx, [rsp + 0x50]
call fcn.140059070
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbp
mov rcx, rax
call fcn.1400593b0
mov r8d, SafeArrayDestroy
lea rdx, str.machineId
lea rcx, [rsp + 0x50]
call fcn.140059070
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r14
mov rcx, rax
call fcn.1400593b0
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
lea r9, [0x1402a1ee0]
mov edx, ebx
mov rcx, rdi
call fcn.1400621e0
movzx ebx, al
mov rcx, rdi
call fcn.1400680cc
nop
cmp qword [rsp + 0x68], 8
jb 0x140062455
mov rcx, qword [rsp + 0x50]
call fcn.1400680cc
movzx eax, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401f2f70
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140063c90
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rcx
lea rax, [r11 - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [0x1402958f0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1402959c0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140063dd6
lea rcx, [rsp + 0x38]
call fcn.140063690
test al, al
je 0x140063dd6
mov qword [rsp + 0x68], 7
xor esi, esi
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x50], si
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], rsi
mov word [rsp + 0x70], si
lea rax, str.model
mov qword [rsp + 0x90], rax
lea rax, str.manufacturer
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x38]
call fcn.1400637e0
movzx ebx, al
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
test bl, bl
je 0x140063d91
lea rcx, [rsp + 0x50]
call fcn.140063b20
mov byte [rdi], al
mov bl, 1
cmp qword [rsp + 0x88], 8
jb 0x140063da6
mov rcx, qword [rsp + 0x70]
call fcn.1400680cc
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], rsi
mov word [rsp + 0x70], si
cmp qword [rsp + 0x68], 8
jb 0x140063dd1
mov rcx, qword [rsp + 0x50]
call fcn.1400680cc
movzx eax, bl
jmp 0x140063dd8
xor al, al
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401f2f70
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140063e60
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov esi, r8d
mov ebp, edx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r15d, r15d
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov edx, ebp
mov rcx, r14
mov dword [rsp + 0x28], MsiSetExternalUIW
mov edi, eax
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140063f0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x140063f08
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0xbb8
jae 0x140063f08
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, r14
mov dword [rsp + 0x28], MsiSetExternalUIW
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140063eb6
jmp 0x140063f0b
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140063f30
Capabilities:
Create directory
Get common file path
Get startup folder
Read file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x2c0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, rcx
mov qword [rsp + 0x58], 7
xor esi, esi
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
lea rax, [r11 - 0x228]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400640dd
lea rdx, str.UniqueId
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x1400640dd
xor edx, edx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140063fdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400640dd
lea rdx, str.data
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x1400640dd
cmp word [rsp + 0xa0], 0
jne 0x14006400c
mov r8, rsi
jmp 0x14006402b
lea rax, [rsp + 0xa0]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140064020
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call fcn.1400267e0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov edx, 0x80000000
mov r8d, 3
call fcn.140063e60
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400640dd
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x38]
mov r8d, 0x40
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400640ca
nop dword [rax]
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x1400640ca
mov r8d, eax
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140058ee0
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x38]
mov r8d, 0x40
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140064090
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rdi + 0x10], 0
seta bl
jmp 0x1400640df
xor bl, bl
cmp qword [rsp + 0x58], 8
jb 0x1400640f1
mov rcx, qword [rsp + 0x40]
call fcn.1400680cc
movzx eax, bl
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1401f2f70
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140064120
Capabilities:
Encrypt data using dpapi

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
mov qword [rbp + 0x47], reloc.OLEAUT32.dll_SafeArrayDestroy
xor edi, edi
mov qword [rbp + 0x3f], rdi
mov byte [rbp + 0x2f], dil
lea rcx, [rbp + 0x2f]
call fcn.140063f30
test al, al
jne 0x140064176
xor bl, bl
jmp 0x140064241
mov qword [rbp + 0x27], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x1f], rdi
mov byte [rbp + 0xf], 0
lea rax, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0x10
cmovae rax, qword [rbp + 0x2f]
mov qword [rbp + 7], rax
mov eax, dword [rbp + 0x3f]
mov dword [rbp - 1], eax
lea rax, str.glority
mov qword [rbp - 9], rax
mov dword [rbp - 0x11], 7
lea rax, [rbp - 0x21]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp - 0x11]
xor edx, edx
lea rcx, [rbp - 1]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
cmp eax, 1
sete al
test al, al
je 0x14006421f
mov r8d, dword [rbp - 0x21]
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp + 0xf]
call fcn.140011130
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rdx, qword [rbp + 0xf]
mov r8, qword [rbp + 0x1f]
shr r8, 1
mov rcx, rbx
call fcn.1400267e0
mov bl, 1
jmp 0x140064221
xor bl, bl
cmp qword [rbp + 0x27], 0x10
jb 0x140064231
mov rcx, qword [rbp + 0xf]
call fcn.1400680cc
mov qword [rbp + 0x27], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x1f], rdi
mov byte [rbp + 0xf], 0
cmp qword [rbp + 0x47], 0x10
jb 0x140064251
mov rcx, qword [rbp + 0x2f]
call fcn.1400680cc
movzx eax, bl
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1401f2f70
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140064280
Capabilities:
Create directory
Delete file
Get common file path
Get startup folder
Write file on windows
Write file to startup folder

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov qword [rsp + 0x58], 7
xor ebp, ebp
mov qword [rsp + 0x50], rbp
mov word [rsp + 0x40], bp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140064406
lea rdx, str.UniqueId
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140064406
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14006432b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140064406
lea rdx, str.data
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140064406
cmp word [rsp + 0x60], 0
jne 0x140064352
mov r8, rbp
jmp 0x14006436b
lea rax, [rsp + 0x60]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140064360
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400267e0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov edx, 0x40000000
mov r8d, 2
call fcn.140063e60
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140064406
mov dword [rsp + 0x38], ebp
lea rdi, [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400643b6
mov rbx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
mov r8d, dword [rdi]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x38]
cmp rcx, qword [rdi]
je 0x1400643fc
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [rsp + 0x38]
mov eax, ecx
cmp rax, qword [rdi]
sete bl
jmp 0x140064408
xor bl, bl
cmp qword [rsp + 0x58], 8
jb 0x14006441a
mov rcx, qword [rsp + 0x40]
call fcn.1400680cc
movzx eax, bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401f2f70
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140064450
Capabilities:
Encrypt data using dpapi

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x14006448b
mov rcx, qword [rcx]
mov qword [rbp + 0x47], reloc.OLEAUT32.dll_SafeArrayDestroy
xor edi, edi
mov qword [rbp + 0x3f], rdi
mov byte [rbp + 0x2f], dil
add r8, r8
mov rdx, rcx
lea rcx, [rbp + 0x2f]
call fcn.140011130
nop
mov qword [rbp + 0x27], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x1f], rdi
mov byte [rbp + 0xf], dil
lea rax, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0x10
cmovae rax, qword [rbp + 0x2f]
mov qword [rbp + 7], rax
mov eax, dword [rbp + 0x3f]
mov dword [rbp - 1], eax
lea rax, str.glority
mov qword [rbp - 9], rax
mov dword [rbp - 0x11], 7
lea rax, [rbp - 0x21]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp - 0x11]
xor edx, edx
lea rcx, [rbp - 1]
call qword [sym.imp.CRYPT32.dll_CryptProtectData]
cmp eax, 1
sete al
test al, al
je 0x140064543
mov r8d, dword [rbp - 0x21]
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp + 0xf]
call fcn.140011130
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rbp + 0xf]
call fcn.140064280
movzx ebx, al
jmp 0x140064545
xor bl, bl
cmp qword [rbp + 0x27], 0x10
jb 0x140064555
mov rcx, qword [rbp + 0xf]
call fcn.1400680cc
mov qword [rbp + 0x27], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x1f], rdi
mov byte [rbp + 0xf], 0
cmp qword [rbp + 0x47], 0x10
jb 0x140064575
mov rcx, qword [rbp + 0x2f]
call fcn.1400680cc
movzx eax, bl
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1401f2f70
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140067630
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbp
mov r14, r8
mov rsi, rdx
mov rbp, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
cmp qword [rcx + 8], rdi
jne 0x140067678
lea rdx, [0x140296e0c]
mov rcx, rsi
call fcn.140011c70
jmp 0x140067802
call fcn.1400694ec
mov rdx, rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x140067697
mov ecx, 0x80004005
call fcn.140011b60
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, [0x140296e0c]
test rdx, 0xffffffffffff0000
jne 0x1400676da
movzx ebx, dx
mov ecx, ebx
call fcn.140068f14
test rax, rax
je 0x1400676e8
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140011830
jmp 0x1400676e8
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.140011b80
nop
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x88], edi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x10], eax
or rdi, 0xffffffffffffffff
mov edx, dword [rsp + 0x70]
test edx, edx
je 0x1400677d8
mov ecx, dword [rsp + 0x88]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x14006776e
lea eax, [rcx - 6]
cmp eax, 1
jbe 0x14006776e
cmp ecx, 4
jne 0x1400677d8
mov rdx, r14
mov rcx, rbp
call fcn.140067820
mov r8d, eax
lea rdx, [0x14029709c]
lea rcx, [rsp + 0x38]
call fcn.140011640
jmp 0x1400677d8
mov eax, 2
mul rdx
cmovo rax, rdi
mov rcx, rax
call fcn.1400680c4
mov rbx, rax
test rax, rax
je 0x1400677d8
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x10], eax
test eax, eax
jne 0x1400677d0
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400677b6
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140011b80
mov rcx, rbx
call fcn.1400680cc
mov rbx, qword [rsp + 0x38]
lea rcx, [rbx - 0x18]
call fcn.1400116e0
add rax, 0x18
mov qword [rsi], rax
lock add dword [rbx - 8], 0xffffffff
jg 0x140067802
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x140067820
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [rbx + 0x10], eax
mov rbx, qword [rsp + 0x48]
cmove edi, dword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret