joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400232ac
Capabilities:
Create process on windows
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x8f0
mov rax, qword [0x1401e3028]
xor rax, rsp
mov qword [rsp + 0x8e0], rax
xor ebp, ebp
mov edi, edx
cmp dword [0x1401e3f88], ebp
mov rbx, rcx
je 0x14002332a
cmp dword [0x1401e3f90], ebp
je 0x14002332a
cmp word [0x1402321a0], bp
je 0x140023306
lea rdx, [0x1402321a0]
lea rcx, str.Launching_browser_with_URL
call fcn.140025aa4
mov rcx, rbx
call fcn.140025b74
cmp word [0x1402321a0], bp
je 0x14002332a
lea rdx, [0x1402321a0]
lea rcx, [0x14018a348]
call fcn.140025aa4
cmp dword [0x1402313f8], ebp
jne 0x14002333e
mov rcx, rbx
call fcn.140022f1c
test eax, eax
je 0x14002334e
mov rcx, rbx
call fcn.1400230f8
test eax, eax
jne 0x140023424
or r14, 0xffffffffffffffff
lea rcx, [rsp + 0xb0]
mov r9, r14
mov r8, rbx
mov edx, 0x824
call fcn.14014f790
test edi, edi
je 0x1400233da
lea rcx, [rsp + 0xb0]
mov rax, r14
inc rax
cmp byte [rcx + rax], bpl
jne 0x140023379
lea edi, [rax + 1]
movsxd rsi, edi
mov rcx, rsi
call fcn.14015319c
mov rbx, rax
test rax, rax
je 0x140023424
test edi, edi
jle 0x1400233b6
mov r9, r14
lea r8, [rsp + 0xb0]
mov rdx, rsi
mov rcx, rax
call fcn.14014f790
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x1400234e0]
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x140023424
mov ebx, 0x70
lea rcx, [rsp + 0x40]
mov r8d, ebx
xor edx, edx
call fcn.140130a00
lea rax, [rsp + 0xb0]
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], 0xa
mov dword [rsp + 0x44], 0x100
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140023424
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x8e0]
xor rcx, rsp
call fcn.14012e400
lea r11, [rsp + 0x8f0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400235ec
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
or rdi, 0xffffffffffffffff
mov rbx, rcx
cmp qword [rcx], rdi
je 0x1400235a1
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx + 0x18], eax
lea ecx, [rax - 1]
cmp ecx, 0xfffffffd
mov rcx, qword [rbx]
ja 0x140023598
and qword [rsp + 0x28], 0
lea r8d, [rdi + 9]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 8], rax
test rax, rax
jne 0x1400235ae
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rdi
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1400235e1
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 8], 0
jmp 0x140023595
mov eax, 1
jmp 0x1400235a3
mov rax, rsp
push rdi
sub rsp, 0x50
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov rbp, rcx
xor esi, esi
and qword [rdx + 0x10], rsi
and qword [rdx + 8], rsi
or qword [rdx], 0xffffffffffffffff
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100008
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002366f
mov rcx, rax
call fcn.140106f88
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002366f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov qword [rbx], rdi
cmp rdi, 0xffffffffffffffff
jne 0x1400236a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x20]
cmp ecx, 1
jbe 0x14002368b
cmp eax, 0x36
jne 0x1400236a2
inc esi
cmp esi, 5
jge 0x1400236a2
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002361c
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp 0x140023544

Function at 0x1400236c0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, rdx
or qword [rdx], 0xffffffffffffffff
mov rsi, rcx
mov qword [rdx + 0x10], rbx
mov qword [rdx + 8], rbx
mov dword [rsp + 0x28], 8
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov rcx, rsi
call fcn.140106fdc
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
jne 0x140023736
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x20]
cmp ecx, 1
jbe 0x140023722
cmp eax, 0x36
jne 0x140023736
inc ebx
cmp ebx, 5
jge 0x140023736
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400236e3
mov rcx, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x140023544
Function at 0x14002379c
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rbx, rcx
cmp word [rcx], r14w
je 0x140023847
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400237c9
movsxd rsi, eax
lea ebp, [rax + 1]
inc rsi
lea rcx, [rsi + rsi]
call fcn.14015319c
mov rdi, rax
test rax, rax
je 0x140023847
test ebp, ebp
jle 0x140023803
or r9, 0xffffffffffffffff
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.1401525e0
mov rbx, rdi
cmp word [rbx], r14w
je 0x14002383f
mov edx, 0x7c
mov rcx, rbx
mov rsi, rbx
call fcn.14012fe28
mov rbx, rax
test rax, rax
je 0x14002382c
mov word [rax], r14w
add rbx, 2
test rsi, rsi
je 0x14002383a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test rbx, rbx
jne 0x140023806
mov rcx, rdi
call fcn.140152ed8
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140023bec
Capabilities:
Set environment variable

Disassembly:
test rdx, rdx
je 0x140023cd6
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, rcx
mov rbx, rdx
mov rcx, rdx
call fcn.140025e70
mov rdi, rax
cmp rax, rcx
je 0x140023cbe
and qword [rsp + 0x38], 0
sub rdi, rcx
and qword [rsp + 0x30], 0
mov r8, rcx
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, dword [0x140231608]
and qword [rsp + 0x20], 0
sar rdi, 1
mov r9d, edi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r14d, [rax + 1]
movsxd r15, r14d
mov rcx, r15
call fcn.14015319c
mov rsi, rax
test rax, rax
je 0x140023cbe
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.140130a00
and qword [rsp + 0x38], 0
mov r9d, edi
and qword [rsp + 0x30], 0
mov r8, rbx
mov ecx, dword [0x140231608]
xor edx, edx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140023cb6
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rcx, rsi
call fcn.140152ed8
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140024bdc
Capabilities:
Create process memory minidump

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8f0
mov rax, qword [0x1401e3028]
xor rax, rsp
mov qword [rsp + 0x8e0], rax
mov r12, r9
mov r15, r8
mov r13, rcx
mov rdi, qword [rsp + 0x950]
mov rsi, qword [rsp + 0x958]
xor eax, eax
mov r14d, eax
cmp dword [0x140226950], eax
je 0x140024e72
mov ebx, dword [rsp + 0x960]
test ebx, ebx
je 0x140024c48
test rdi, rdi
je 0x140024e72
test rsi, rsi
je 0x140024e72
xor edx, edx
mov r8d, 0x820
lea rcx, [rsp + 0xc0]
call fcn.140130a00
movzx ecx, word [0x140227108]
xor r8d, r8d
test cx, cx
je 0x140024cbc
cmp cx, word [0x14018b2bc]
jne 0x140024c8b
movzx eax, word [reloc.OLEAUT32.dll_SysStringLen]
cmp ax, word [0x14018b2be]
jne 0x140024c8b
lea r14d, [r8 + 1]
jmp 0x140024cbc
lea rax, [0x140227108]
lea rdx, [rsp + 0xc0]
mov qword [rdx], rax
test cx, cx
je 0x140024cac
add rax, 2
cmp word [rax], r8w
jne 0x140024ca2
add rdx, 8
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140024c9a
test ebx, ebx
je 0x140024cdc
or r9, 0xffffffffffffffff
lea r8, str.unknown
mov edx, 0x104
lea rcx, [0x14023089a]
call fcn.1401525e0
call fcn.140022bcc
test eax, eax
jne 0x140024cec
xor eax, eax
jmp 0x140024e72
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40000000
mov r9, r13
mov r8, r12
lea rdx, [0x140231400]
lea rcx, [rsp + 0x50]
call fcn.140023a84
xor r12d, r12d
test eax, eax
je 0x140024ce5
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
mov dword [rsp + 0x98], r14d
lea rax, [0x1402303c4]
mov qword [rsp + 0xa0], rax
mov eax, dword [0x140226954]
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0x9c], ebx
mov rcx, qword [0x140226960]
test rcx, rcx
je 0x140024d80
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x64], rcx
mov dword [rsp + 0x6c], 1
lea rax, [0x140024920]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x78], rax
cmp dword [0x1402303c4], r12d
je 0x140024db2
mov eax, dword [0x1402303c8]
test ebx, ebx
je 0x140024db7
bts eax, 0xa
jmp 0x140024db7
mov eax, 0x121
mov r9d, eax
bts r9d, 9
test ebx, ebx
cmovne r9d, eax
neg rcx
sbb rax, rax
lea rcx, [rsp + 0x60]
and rax, rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x50]
mov edx, dword [0x140226950]
mov rcx, qword [0x140226988]
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
test eax, eax
jne 0x140024e0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x140024e72
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140024e2f
lea rdx, [0x140230858]
lea rcx, [0x14023089a]
call fcn.1400253c4
mov rdx, r15
mov rcx, r13
call fcn.1400236c0
test eax, eax
je 0x140024ce5
cmp dword [r15 + 0x18], r12d
je 0x140024ce5
test ebx, ebx
je 0x140024e69
mov rcx, qword [0x140230ab8]
test rcx, rcx
cmove rcx, qword [0x140226958]
mov qword [0x140230ab8], rcx
mov eax, 1
jmp 0x140024e72
mov rcx, qword [rsp + 0x8e0]
xor rcx, rsp
call fcn.14012e400
add rsp, 0x8f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140024e98
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov rbx, rcx
test rcx, rcx
je 0x140024fa7
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140024ec1
lea esi, [rax + 1]
movsxd r15, esi
lea r14, [r15 + r15]
mov rcx, r14
call fcn.14015319c
mov rdi, rax
test rax, rax
je 0x140024fa7
mov ebp, r12d
test esi, esi
jle 0x140024f02
or r9, 0xffffffffffffffff
mov r8, rbx
mov rdx, r15
mov rcx, rax
call fcn.1401525e0
mov esi, 1
lea rbx, [rdi - 2]
add rbx, r14
lea r14d, [rsi + 0x5b]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140024f25
and eax, 0x10
jne 0x140024f92
mov rcx, rdi
mov r8, rbx
call fcn.140025e70
mov rbx, rax
test ebp, ebp
je 0x140024f3b
mov word [r8], r14w
cmp rax, rdi
jbe 0x140024f98
mov word [rax], r12w
mov ebp, esi
jmp 0x140024f12
mov word [rbx], r14w
mov ebp, r12d
add rbx, 2
movzx eax, word [rbx]
cmp ax, r14w
je 0x140024f7d
movzx ecx, ax
movzx eax, cx
test cx, cx
je 0x140024f77
add rbx, 2
movzx eax, word [rbx]
movzx ecx, ax
cmp ax, r14w
jne 0x140024f5f
cmp ax, r14w
jne 0x140024f83
mov ebp, esi
mov word [rbx], r12w
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140024f98
test ebp, ebp
jne 0x140024f48
jmp 0x140024f9b
mov esi, r12d
mov rcx, rdi
call fcn.140152ed8
mov eax, esi
jmp 0x140024fa9
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140024fc0
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
and dword [rax + 0x20], 0
mov rsi, rdx
and dword [rax - 0x28], 0
lea rdx, [rax + 0x20]
mov r14, r8
mov rbp, rcx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x14002507e
mov ecx, edi
call fcn.14015319c
mov rbx, rax
test rax, rax
je 0x14002507e
mov r9, rax
mov r8d, edi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140025076
lea r9, [rsp + 0x20]
mov rcx, rbx
lea r8, [rsp + 0x28]
lea rdx, [0x14018a3a4]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x140025076
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + 0xa]
mov word [rsi], ax
movzx eax, word [rcx + 8]
mov word [rsi + 2], ax
movzx eax, word [rcx + 0xe]
mov word [rsi + 4], ax
movzx eax, word [rcx + 0xc]
mov word [rsi + 6], ax
mov ecx, dword [rcx + 0x1c]
and ecx, 1
mov dword [r14], ecx
mov rcx, rbx
call fcn.140152ed8
mov eax, 1
jmp 0x140025080
mov rcx, rbx
call fcn.140152ed8
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400254b0
Capabilities:
Access the windows event log

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
movzx ebp, dx
mov r14, rcx
lea rdx, [0x140231f90]
xor ecx, ecx
mov rbx, r9
mov esi, r8d
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
xor edx, edx
mov rdi, rax
test rax, rax
je 0x140025540
test rbx, rbx
je 0x140025502
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], dx
jne 0x1400254f7
jmp 0x140025505
mov rcx, rdx
mov qword [rsp + 0x40], rbx
lea eax, [rcx + rcx]
mov qword [rsp + 0x38], r14
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov r9d, esi
mov word [rsp + 0x28], bp
mov rcx, rdi
mov qword [rsp + 0x20], rdx
movzx edx, word [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x140025aa4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor edi, edi
mov r14, rdx
or rbx, 0xffffffffffffffff
mov rbp, rcx
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov edx, 0x40000000
mov rcx, r14
call fcn.140106fdc
mov rsi, rax
cmp rax, rbx
jne 0x140025b18
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea ecx, [rax - 0x20]
cmp ecx, 1
jbe 0x140025b04
cmp eax, 0x36
jne 0x140025b61
inc edi
cmp edi, 5
jge 0x140025b61
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140025ac2
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test rbp, rbp
je 0x140025b3c
inc rbx
cmp byte [rbx + rbp], 0
jne 0x140025b31
jmp 0x140025b3e
xor ebx, ebx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8d, ebx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14002624c
Capabilities:
Parse url

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x8f8]
sub rsp, 0x9f0
mov rax, qword [0x1401e3028]
xor rax, rsp
mov qword [rbp + 0x8e0], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x824
mov edi, 0x68
lea rcx, [rsp + 0x30]
mov r8d, edi
xor edx, edx
call fcn.140130a00
mov dword [rsp + 0x30], edi
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x104
test rbx, rbx
je 0x140026443
mov edi, 0x10000000
lea r8, [rsp + 0x20]
mov r9d, edi
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
je 0x140026443
mov edx, dword [rsp + 0x20]
lea r9, [rsp + 0x30]
mov r8d, edi
lea rcx, [rbp + 0xb0]
call qword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x140026443
mov eax, dword [rsp + 0x44]
add eax, 0xfffffffd
cmp eax, 1
ja 0x140026443
mov rax, qword [rsp + 0x48]
or rbx, 0xffffffffffffffff
test rax, rax
je 0x14002632a
mov rdi, rbx
inc rdi
cmp byte [rdi + rax], 0
jne 0x14002631f
jmp 0x14002632c
xor edi, edi
lea rsi, str.http:__
mov rax, rbx
inc rax
cmp byte [rsi + rax], 0
jne 0x140026336
movsxd r8, eax
lea rcx, [rbp + 0xb0]
mov rdx, rsi
call fcn.140152914
test eax, eax
mov rax, rbx
jne 0x140026363
inc rax
cmp byte [rsi + rax], 0
jne 0x140026358
jmp 0x140026399
lea rsi, str.https:__
inc rax
cmp byte [rsi + rax], 0
jne 0x14002636a
movsxd r8, eax
lea rcx, [rbp + 0xb0]
mov rdx, rsi
call fcn.140152914
test eax, eax
jne 0x140026443
mov rax, rbx
inc rax
cmp byte [rsi + rax], 0
jne 0x140026390
cdqe
lea rcx, [rbp + 0xb0]
add rcx, rax
jmp 0x1400263b2
test al, al
je 0x140026443
inc rcx
mov al, byte [rcx]
cmp al, 0x2f
jne 0x1400263a7
test al, al
je 0x140026443
movsxd rsi, edi
lea rdx, str..microsoft.com
add rsi, qword [rsp + 0x48]
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x1400263d2
cmp edi, eax
jl 0x1400263f1
movsxd r8, eax
mov rcx, rsi
sub rcx, r8
call fcn.140152914
test eax, eax
je 0x14002643c
lea rdx, str..msn.com
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x1400263fb
cmp edi, eax
jl 0x14002641a
movsxd r8, eax
sub rsi, r8
mov rcx, rsi
call fcn.140152914
test eax, eax
je 0x14002643c
lea rdx, str.microsoft.com
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140026421
cmp edi, ebx
jne 0x140026443
mov rcx, qword [rsp + 0x48]
call fcn.1401527fc
test eax, eax
jne 0x140026443
mov eax, 1
jmp 0x140026445
xor eax, eax
mov rcx, qword [rbp + 0x8e0]
xor rcx, rsp
call fcn.14012e400
lea r11, [rsp + 0x9f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140026574
Capabilities:
Get common file path
Query or enumerate registry value
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1401e3028]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400265bf
lea rdx, [rsp + 0x40]
lea rcx, str.systemdir
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor r8d, r8d
lea rcx, str.shfolder.dll
call fcn.140021e80
mov rbx, rax
test rax, rax
je 0x1400266d3
lea rdx, str.SHGetFolderPathA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400266ca
xor r9d, r9d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
mov rax, rdi
lea edx, [r9 + 0x26]
call qword [case.0x14000c75c.0]
test eax, eax
jne 0x14002662b
lea rdx, [rsp + 0x40]
lea rcx, str.progfiles
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor r9d, r9d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
mov rax, rdi
lea edx, [r9 + 0x2b]
call qword [case.0x14000c75c.0]
test eax, eax
jne 0x140026660
lea rdx, [rsp + 0x40]
lea rcx, str.commonfiles
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor r9d, r9d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
mov rax, rdi
lea edx, [r9 + 0x1a]
call qword [case.0x14000c75c.0]
test eax, eax
jne 0x140026695
lea rdx, [rsp + 0x40]
lea rcx, str.appdata
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor r9d, r9d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
mov rax, rdi
lea edx, [r9 + 5]
call qword [case.0x14000c75c.0]
test eax, eax
jne 0x1400266ca
lea rdx, [rsp + 0x40]
lea rcx, str.mydocuments
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftOffice11.0CommonInstallRoot
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140026782
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x14018b654]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0x104
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140026777
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140026743
cdqe
cmp byte [rsp + rax + 0x3f], 0x5c
jne 0x140026765
dec rax
cmp rax, 0x104
jae 0x1400267a3
mov byte [rsp + rax + 0x40], 0
lea rdx, [rsp + 0x40]
lea rcx, str.officedir
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.14012e400
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14012e568
int3
Function at 0x140026a50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov r13, r8
mov rdi, rcx
mov ebp, ebx
test rcx, rcx
je 0x140026bba
mov r14d, 0x10000
mov ecx, r14d
call fcn.14015319c
mov rsi, rax
test rax, rax
je 0x140026bba
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.140130a00
mov rcx, qword [rdi]
mov r15d, 0x8000
mov r12, rsi
mov r14d, ebx
test rcx, rcx
je 0x140026af8
mov rax, rdi
mov r8d, dword [rax + 0x10]
mov r9, r12
mov rdx, qword [rax + 8]
mov rax, qword [rax + 0x18]
mov dword [rsp + 0x20], r15d
call qword [case.0x14000c75c.0]
mov ecx, eax
lea r12, [r12 + rcx*2]
sub r15d, eax
je 0x140026bae
inc r14d
mov eax, r14d
shl rax, 5
add rax, rdi
mov rcx, qword [rax]
test rcx, rcx
jne 0x140026aba
mov r15, qword [rsp + 0x88]
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x28], ebx
mov r9, r13
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x40000000
mov rcx, r15
call fcn.140106fdc
mov r14, rax
cmp rax, rdi
jne 0x140026b60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [rsp + 0x80], eax
add eax, 0xffffffe0
cmp eax, 1
jbe 0x140026b47
cmp ecx, 0x36
jne 0x140026bae
inc ebp
cmp ebp, 5
jge 0x140026b59
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebp, 0x32
jl 0x140026b04
jmp 0x140026bae
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x140026b71
lea r8d, [rdi + rdi]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x80]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov rcx, rsi
call fcn.140152ed8
mov eax, ebx
jmp 0x140026bbc
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret