joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007e7c0
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x6b0
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rbp, rcx
mov ebx, edx
lea rcx, [rsp + 0x492]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x490], di
call fcn.1400ad2f0
lea r8, [0x1400ef568]
lea rcx, [rsp + 0x490]
mov rdx, rbp
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
jne 0x14007e83e
xor eax, eax
jmp 0x14007e94b
lea rcx, [rsp + 0x282]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x6e0], rsi
mov word [rsp + 0x280], di
call fcn.1400ad2f0
nop word [rax + rax]
lea r8, [rsp + 0x5c]
lea rcx, [rsp + 0x280]
mov rdx, rbp
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rsi, [rsp + 0x5c]
lea rdi, [0x1400fc94c]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14007e8fa
lea rsi, [rsp + 0x5c]
lea rdi, [0x1400ef560]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14007e8fa
mov eax, dword [rsp + 0x30]
cmp eax, 0xffffffff
je 0x14007e8d6
test al, 1
je 0x14007e8d6
and eax, 0xfffffffe
lea rcx, [rsp + 0x280]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [rsp + 0x30]
test al, 0x10
je 0x14007e8eb
lea rcx, [rsp + 0x280]
mov edx, ebx
call fcn.14007e7c0
jmp 0x14007e8fa
lea rcx, [rsp + 0x280]
mov edx, ebx
call fcn.14007e6a0
mov rdi, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14007e870
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x6e0]
test ebx, ebx
jne 0x14007e937
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14007e946
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, 1
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.1400ad2c0
add rsp, 0x6b0
pop rdi
pop rbp
pop rbx
ret
Function at 0x14007e970
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, qword [rsp + 0x80]
mov edi, ecx
mov esi, r9d
mov rcx, rbp
call fcn.14007d600
xor ebx, ebx
mov qword [rsp + 0x38], rbx
test edi, edi
je 0x14007ea71
sub edi, 1
je 0x14007ea68
sub edi, 1
je 0x14007ea1e
sub edi, 1
je 0x14007e9d2
cmp edi, 1
jne 0x14007ebbe
mov rcx, 0xffffffff80000000
jmp 0x14007ea78
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov r9d, esi
mov ecx, 1
mov r8, rdi
mov rdx, rbx
mov qword [rsp + 0x20], rbp
call fcn.14007e970
test eax, eax
jne 0x14007ebc0
mov r9d, esi
mov r8, rdi
mov rdx, rbx
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call fcn.14007e970
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov r9d, esi
xor ecx, ecx
mov r8, rdi
mov rdx, rbx
mov qword [rsp + 0x20], rbp
call fcn.14007e970
test eax, eax
jne 0x14007ebc0
lea ecx, [rax + 1]
mov r9d, esi
mov r8, rdi
mov rdx, rbx
mov qword [rsp + 0x20], rbp
call fcn.14007e970
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rcx, 0xffffffff80000002
jmp 0x14007ea78
mov rcx, 0xffffffff80000001
mov rdx, qword [rsp + 0x68]
lea rax, [rsp + 0x38]
or esi, 1
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007ebbe
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rdi
xor r8d, r8d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007ebb3
mov eax, dword [rsp + 0x60]
test eax, eax
jne 0x14007eae8
lea ebx, [rax + 1]
jmp 0x14007ebb3
lea ecx, [rax + 2]
call fcn.140097a1c
mov r8d, dword [rsp + 0x60]
xor edx, edx
add r8d, 2
mov rcx, rax
mov rsi, rax
call fcn.1400ad2f0
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007ebab
cmp dword [rsp + 0x30], 2
jne 0x14007eb88
mov ecx, dword [rsp + 0x60]
add ecx, 0x104
call fcn.140097a1c
mov r8d, dword [rsp + 0x60]
mov rcx, rsi
add r8d, 0x104
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
mov rdx, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call fcn.140025a70
mov rcx, rbx
call fcn.1400ad0b8
jmp 0x14007eba6
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov rdx, rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call fcn.140025a70
mov ebx, 1
mov rcx, rsi
call fcn.1400ad0b8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007f110
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rbp, rdx
mov rbx, rcx
mov qword [rax - 0x28], rcx
xor esi, esi
mov dword [rax - 0x34], esi
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], rsi
lea rdi, [rcx + 8]
mov word [rdi], si
mov dword [rax - 0x34], 1
mov qword [rax - 0x48], rcx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.HTTP_shellopencommand
lea ecx, [rsi + 4]
call fcn.14007e970
test eax, eax
je 0x14007f201
cmp qword [rbx + 0x18], rsi
je 0x14007f1fc
mov dword [rsp + 0x30], esi
cmp qword [rbx + 0x20], 8
jb 0x14007f189
mov rdi, qword [rdi]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
je 0x14007f1f7
test rbp, rbp
je 0x14007f1c2
mov rdx, qword [rax]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call fcn.140025a70
mov rcx, qword [rsi]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.140025a70
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
jmp 0x14007f204
mov rax, rbx
jmp 0x14007f204
mov rax, rbx
jmp 0x14007f204
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140080800
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
sub rsp, 0x248
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], ax
call fcn.1400ad2f0
mov r9d, 1
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x19]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.WeatherTool
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.WeatherTool
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1400808a2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140080896
test al, 1
je 0x140080896
and eax, 0xfffffffe
lea rcx, [rsp + 0x20]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.14007e7c0
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400ad2c0
add rsp, 0x248
ret
Function at 0x1400808c0
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbp, rdx
mov rbx, rcx
mov qword [r11 - 0x78], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], rsi
lea rdi, [rcx + 8]
mov word [rdi], si
mov dword [rsp + 0x30], 1
mov qword [r11 - 0x50], 7
mov qword [r11 - 0x58], rsi
mov word [rsp + 0x50], si
lea rax, [r11 - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x100
lea r8, str.Progid
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
lea ecx, [rsi + 2]
call fcn.14007e970
test eax, eax
je 0x140080a2b
lea r8, str._shellopencommand
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.140037aa0
nop
lea rdx, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae rdx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rsi + 4]
call fcn.14007e970
test eax, eax
je 0x140080a15
cmp qword [rbx + 0x18], rsi
je 0x140080a15
mov dword [rsp + 0x34], esi
cmp qword [rbx + 0x20], 8
jb 0x1400809ab
mov rdi, qword [rdi]
lea rdx, [rsp + 0x34]
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
je 0x140080a15
test rbp, rbp
je 0x1400809e4
mov rdx, qword [rax]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call fcn.140025a70
mov rcx, qword [rsi]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.140025a70
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
cmp qword [rsp + 0x90], 8
jb 0x140080a2b
mov rcx, qword [rsp + 0x78]
call fcn.1400ad0b8
nop
cmp qword [rsp + 0x68], 8
jb 0x140080a42
mov rcx, qword [rsp + 0x50]
call fcn.1400ad0b8
mov rax, rbx
jmp 0x140080a45
mov rax, rbx
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400ad2c0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140080ac0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rcx
cmp qword [rcx + 0x20], 8
jb 0x140080b01
lea rbx, [rcx + 8]
mov r9, qword [rbx]
jmp 0x140080b08
lea rbx, [rcx + 8]
mov r9, rbx
xor esi, esi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea r8, str.spark.exe
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
ja 0x140080c00
mov qword [rsp + 0x80], 7
mov qword [rsp + 0x78], rsi
mov word [rsp + 0x68], si
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140080a70
nop
cmp qword [rsp + 0x50], rsi
je 0x140080b79
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae rcx, qword [rsp + 0x68]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140080b90
mov r8d, 0xc
lea rdx, str.iexplore.exe
lea rcx, [rsp + 0x38]
call fcn.140025a70
cmp qword [rdi + 0x20], 8
jb 0x140080b9a
mov rbx, qword [rbx]
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
cmp qword [rsp + 0x58], 8
jb 0x140080bd8
mov rcx, qword [rsp + 0x40]
call fcn.1400ad0b8
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
cmp qword [rsp + 0x80], 8
jb 0x140080c00
mov rcx, qword [rsp + 0x68]
call fcn.1400ad0b8
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400ad2c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140082ba0
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x6d0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov ebp, r9d
mov r12, r8
mov rdi, rdx
mov r13, rcx
xor r14d, r14d
mov word [rsp + 0x4b0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x4b2]
call fcn.1400ad2f0
mov r8, rdi
mov rdx, r13
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140082c31
xor eax, eax
jmp 0x140082da7
mov word [rsp + 0x2a0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2a2]
call fcn.1400ad2f0
nop
test byte [rsp + 0x50], 0x10
jne 0x140082d83
test ebp, ebp
je 0x140082d04
lea r8, [rsp + 0x7c]
mov rdx, r13
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r14
mov word [rsp + 0x28], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2a0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x20]
call fcn.140025a70
nop
mov rbx, qword [r12 + 0x28]
lea r9, [rsp + 0x20]
mov r8, qword [rbx + 8]
mov rdx, rbx
mov rcx, r12
call fcn.14007fc40
mov rdi, rax
mov edx, 1
mov rcx, r12
call fcn.14007ee30
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
cmp qword [rsp + 0x40], 8
jb 0x140082d83
mov rcx, qword [rsp + 0x28]
call fcn.1400ad0b8
jmp 0x140082d83
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r14
mov word [rsp + 0x28], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x7c]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x20]
call fcn.140025a70
nop
mov rbx, qword [r12 + 0x28]
lea r9, [rsp + 0x20]
mov r8, qword [rbx + 8]
mov rdx, rbx
mov rcx, r12
call fcn.14007fc40
mov rdi, rax
mov edx, 1
mov rcx, r12
call fcn.14007ee30
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
cmp qword [rsp + 0x40], 8
jb 0x140082d83
mov rcx, qword [rsp + 0x28]
call fcn.1400ad0b8
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140082c50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.1400ad2c0
add rsp, 0x6d0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400858e0
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rsi
mov rbx, rcx
mov ecx, 8
call fcn.1400aee14
xor ebp, ebp
test rax, rax
je 0x14008591f
lea rcx, [rsp + 0x28]
mov qword [rax], rcx
jmp 0x140085922
mov rax, rbp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.14007a6d0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbp
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140084c50
test eax, eax
jne 0x1400859a3
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x50]
mov qword [rax + 8], rax
mov qword [rsp + 0x58], rbp
mov rax, qword [rsp + 0x50]
cmp rcx, rax
je 0x140085985
nop
mov rbx, qword [rcx]
call fcn.1400ad0b8
mov rcx, rbx
mov rax, qword [rsp + 0x50]
cmp rbx, rax
jne 0x140085970
mov rcx, rax
call fcn.1400ad0b8
mov qword [rsp + 0x50], rbp
mov rcx, qword [rsp + 0x28]
call fcn.1400ad0b8
xor eax, eax
jmp 0x140085a91
mov rax, qword [rsp + 0x50]
mov rsi, qword [rax]
mov rdi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x50]
test rdi, rdi
je 0x1400859c1
cmp rdi, qword [rsp + 0x28]
je 0x1400859c6
call fcn.1400aedac
cmp rsi, rbx
je 0x140085a3b
test rdi, rdi
jne 0x1400859da
call fcn.1400aedac
mov r11, rbp
jmp 0x1400859dd
mov r11, qword [rdi]
cmp rsi, qword [r11 + 0x28]
jne 0x1400859e8
call fcn.1400aedac
mov r8d, dword [rsi + 0x10]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test rdi, rdi
jne 0x140085a17
call fcn.1400aedac
mov r11, rbp
jmp 0x140085a1a
mov r11, qword [rdi]
cmp rsi, qword [r11 + 0x28]
jne 0x140085a25
call fcn.1400aedac
mov rsi, qword [rsi]
test rbx, rbx
je 0x1400859b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400859b0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x50]
mov qword [rax + 8], rax
mov qword [rsp + 0x58], rbp
mov rax, qword [rsp + 0x50]
cmp rcx, rax
je 0x140085a75
nop
mov rbx, qword [rcx]
call fcn.1400ad0b8
mov rcx, rbx
mov rax, qword [rsp + 0x50]
cmp rbx, rax
jne 0x140085a60
mov rcx, rax
call fcn.1400ad0b8
mov qword [rsp + 0x50], rbp
mov rcx, qword [rsp + 0x28]
call fcn.1400ad0b8
mov eax, 1
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400863e0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x40]
lea rdx, str.SOFTWAREDtsEncodeTools
xor ebx, ebx
mov r9d, 0x102
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007c23a
mov rcx, qword [rsp + 0x40]
lea rdx, str.3B7FD029_D932_411b_AF15_C96CF8EF0C18
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x60], bx
call fcn.1400ad2f0
lea rax, [rsp + 0x50]
lea rdx, str.SOFTWAREDtsEncodeTools
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007c2d2
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x14007c2d2
lea r8d, [rax - 3]
lea rdx, str.SOFTWAREDtsEncodeTools
mov rcx, 0xffffffff80000002
call fcn.14007b850
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400ad2c0
add rsp, 0x280
pop rbx
ret
sub rsp, 0x28
call fcn.140085ab0
call fcn.140082e40
call fcn.140080800
lea rdx, str.softwareWeatherTool
mov r8d, 0x100
mov rcx, 0xffffffff80000001
call fcn.14007b850
lea rdx, str.softwareWeatherTool
mov r8d, 0x100
mov rcx, 0xffffffff80000002
call fcn.14007b850
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallWeatherTool
mov r8d, 0x100
mov rcx, 0xffffffff80000002
call fcn.14007b850
add rsp, 0x28
jmp 0x14007c1d0
Function at 0x140087040
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x690
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x688], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
lea rax, vtable.baidulog::Clog.0
mov qword [rcx], rax
mov qword [rcx + 0x30], 7
xor esi, esi
mov qword [rcx + 0x28], rsi
mov word [rcx + 0x18], si
mov qword [rcx + 0x58], 7
mov qword [rcx + 0x50], rsi
mov word [rcx + 0x40], si
mov qword [rcx + 0x80], 7
mov qword [rcx + 0x78], rsi
mov word [rcx + 0x68], si
mov qword [rcx + 0xa8], 7
mov qword [rcx + 0xa0], rsi
mov word [rcx + 0x90], si
mov qword [rcx + 0xd0], 7
mov qword [rcx + 0xc8], rsi
mov word [rcx + 0xb8], si
lea rdi, [rcx + 0xe8]
lea ecx, [rsi + 8]
call fcn.1400aee14
test rax, rax
je 0x140087100
mov qword [rax], rdi
jmp 0x140087103
mov rax, rsi
mov qword [rdi], rax
mov qword [rdi + 0x18], rsi
mov qword [rdi + 0x20], rsi
mov qword [rdi + 0x28], rsi
mov qword [rbx + 8], rsi
xor edx, edx
mov r8d, 0x114
lea rcx, [rsp + 0x50]
call fcn.1400ad2f0
mov dword [rsp + 0x50], 0x114
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r9d, dword [rsp + 0x58]
mov r8d, dword [rsp + 0x54]
lea rdx, str._d._d
lea rcx, [rsp + 0x470]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x470]
lea r8, [0x1400f0628]
mov rdx, rdi
mov rcx, rbx
call fcn.140086450
mov dword [rsp + 0x34], 0x208
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x260]
call fcn.1400ad2f0
mov dword [rsp + 0x30], esi
mov word [rsp + 0x50], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.1400ad2f0
lea r8, [0x1400f9500]
lea rdx, str.softwareWeatherTool
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea r11, [rsp + 0x38]
mov qword [rsp + 0x20], r11
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140087223
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.parentName
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x260]
lea r8, str.parentName
mov rdx, rdi
mov rcx, rbx
call fcn.140086450
nop
mov rax, rbx
mov rcx, qword [rsp + 0x688]
xor rcx, rsp
call fcn.1400ad2c0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140088340
Capabilities:
Schedule task via itaskscheduler

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x260
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov qword [rcx + 0x20], 7
xor r13d, r13d
mov qword [rcx + 0x18], r13
mov word [rcx + 8], r13w
mov qword [rcx + 0x48], 7
mov qword [rcx + 0x40], r13
mov word [rcx + 0x30], r13w
mov qword [rcx + 0x70], 7
mov qword [rcx + 0x68], r13
mov word [rcx + 0x58], r13w
mov dword [rcx + 0x78], r13d
mov dword [rcx + 0x7c], r13d
lea rdi, [rcx + 0x80]
mov qword [rdi], r13
mov qword [rcx + 0x88], r13
mov qword [rsp + 0x20], rdi
lea r9, [0x1400f3d48]
xor edx, edx
lea r8d, [r13 + 1]
lea rcx, [0x1400f3d68]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140088402
mov dword [rbx + 0x78], 0x12d
mov dword [rbx + 0x7c], eax
mov rax, rbx
jmp 0x14008849d
mov rcx, qword [rdi]
mov rax, qword [rcx]
lea r9, [rbx + 0x88]
lea r8, [0x1400f3d28]
lea rdx, str.WeatherTool_start_schedule_task
call qword [rax + 0x30]
mov word [rsp + 0x40], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x42]
call fcn.1400ad2f0
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140025a70
mov r8d, 6
lea rdx, str._start
lea rcx, [rbx + 0x28]
call fcn.140025a70
mov r8d, 0x1d
lea rdx, str.WeatherTool_update_and_start.
lea rcx, [rbx + 0x50]
call fcn.140025a70
nop
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ad2c0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret