joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000aa8d0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rbx, r9
mov rsi, rdx
mov r10, rcx
mov qword [r11 + 0x10], rbp
cmp rdx, rbp
je 0x1000aaa17
cmp word [rdx], bp
je 0x1000aaa17
cmp rbx, rbp
je 0x1000aa9f7
cmp word [r9], bp
je 0x1000aa9f7
mov eax, dword [0x1000e2a08]
mov qword [r11 - 0x18], rbp
neg eax
lea rax, [r11 + 0x10]
sbb ecx, ecx
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbp
and ecx, 0x100
xor r9d, r9d
xor r8d, r8d
add ecx, 0x20006
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp eax, ebp
je 0x1000aa97c
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aa9e3
test byte [rcx + 0x1c], 1
je 0x1000aa9e3
lea edx, [rbp + 0x22]
mov r9, rsi
jmp 0x1000aa9cf
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x80]
mov r9d, 0xb
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp eax, ebp
je 0x1000aa9e3
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aa9e3
test byte [rcx + 0x1c], 1
je 0x1000aa9e3
mov edx, 0x23
mov r9, rbx
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
mov dword [rsp + 0x20], eax
call fcn.100020b88
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x1000aa9f3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000aaa4a
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aaa45
test byte [rcx + 0x1c], 1
je 0x1000aaa45
mov edx, 0x21
jmp 0x1000aaa35
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aaa45
test byte [rcx + 0x1c], 1
je 0x1000aaa45
mov edx, 0x20
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
call fcn.100020584
mov eax, 0x57
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1000aaa68
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rbx, r8
mov qword [r11 + 0x10], rsi
cmp rdx, rsi
je 0x1000aab0e
cmp word [rdx], si
je 0x1000aab0e
cmp rbx, rsi
je 0x1000aaaee
cmp word [r8], si
je 0x1000aaaee
mov eax, dword [0x1000e2a08]
neg eax
lea rax, [r11 + 0x10]
sbb r9d, r9d
xor r8d, r8d
mov qword [r11 - 0x18], rax
and r9d, 0x100
add r9d, 0x20006
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, esi
jne 0x1000aaada
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
mov rcx, qword [rsp + 0x48]
cmp rcx, rsi
je 0x1000aaaea
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000aab41
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aab3c
test byte [rcx + 0x1c], 1
je 0x1000aab3c
mov edx, 0x25
jmp 0x1000aab2c
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aab3c
test byte [rcx + 0x1c], 1
je 0x1000aab3c
mov edx, 0x24
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
call fcn.100020584
mov eax, 0x57
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1000abaa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebp, dword [rsp + 0xa0]
mov r15, r8
mov r13d, edx
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
cmp dword [rsp + 0xa0], 0xffffffff
je 0x1000abaf5
cmp dword [rsp + 0xa0], 0
je 0x1000abaf5
mov ebp, dword [rsp + 0xa0]
sub ebp, ebx
mov r9d, ebp
xor r8d, r8d
mov rdx, r15
mov ecx, r13d
mov dword [rsp + 0x20], 0x4ff
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
cmp eax, r13d
jne 0x1000abb4e
mov ebx, 1
jmp 0x1000abb33
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1000abb1d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, r12d
cmp r12d, eax
jbe 0x1000abb60
dec ebx
cmp edi, r13d
je 0x1000abad8
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000abb9e
test byte [rcx + 0x1c], 4
je 0x1000abb9e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
mov edx, 0x54
mov r9, r14
mov dword [rsp + 0x20], ebx
call fcn.100020b88
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x1000abbc8
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x4a0
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov r12, rcx
xor r13d, r13d
lea rcx, [rsp + 0x34]
xor edx, edx
mov r8d, 0x24c
mov edi, r13d
mov dword [rsp + 0x30], r13d
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x282]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x280], r13w
call sub.msvcrt.dll_memset
cmp r12, r13
jne 0x1000abc75
lea edi, [r13 + 0x57]
mov rcx, qword [0x1000dedd8]
lea rbx, [0x1000dedd8]
cmp rcx, rbx
je 0x1000abe2c
test byte [rcx + 0x1c], 1
je 0x1000abe2c
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xc]
lea r8, [0x100002ff8]
call fcn.100020584
jmp 0x1000abe2c
lea rax, [0x10001a8e0]
lea r8, [0x10001a760]
lea rcx, [rsp + 0x280]
mov r9, r12
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.100058674
cmp eax, r13d
jge 0x1000abce8
mov edi, eax
and edi, 0x1000ffff
mov rcx, qword [0x1000dedd8]
lea rbx, [0x1000dedd8]
cmp rcx, rbx
je 0x1000abe2c
test byte [rcx + 0x1c], 1
je 0x1000abe2c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
mov edx, 0x64
mov r9d, eax
call fcn.100020d8c
jmp 0x1000abe2c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1000abd45
mov rcx, qword [0x1000dedd8]
lea rbx, [0x1000dedd8]
cmp rcx, rbx
je 0x1000abe1d
test byte [rcx + 0x1c], 4
je 0x1000abe1d
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x66]
lea r9, [rsp + 0x280]
lea r8, [0x100002ff8]
call fcn.100020614
jmp 0x1000abe1d
lea rbx, [0x1000dedd8]
cmp dword [rsp + 0x30], 0x10
je 0x1000abe06
lea rax, [rsp + 0x5c]
lea r8, [0x10001a760]
lea rcx, [rsp + 0x280]
mov r9, r12
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.100058674
cmp eax, r13d
mov ebp, eax
jl 0x1000abdd4
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r13d
jne 0x1000abe06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000abe06
test byte [rcx + 0x1c], 1
je 0x1000abe06
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x280]
lea r8, [0x100002ff8]
mov edx, 0x66
mov dword [rsp + 0x20], eax
call fcn.100020b88
jmp 0x1000abe06
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000abdfe
test byte [rcx + 0x1c], 1
je 0x1000abdfe
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
mov edx, 0x67
mov r9d, eax
call fcn.100020d8c
mov edi, ebp
and edi, 0x1000ffff
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r13d
jne 0x1000abd4c
cmp rsi, 0xffffffffffffffff
je 0x1000abe2c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1000cd7d0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1000ad074
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebx, ebx
lea rax, [rcx + 0x48]
mov rdi, rcx
mov dword [rax + 0x30], ebx
mov dword [rax + 0x34], ebx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x28], rax
lea rax, [rcx + 0x88]
xor edx, edx
mov dword [rax + 0x30], ebx
mov dword [rax + 0x34], ebx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x28], rax
lea rax, [rcx + 0xc8]
mov r8d, 0x110
mov dword [rax + 0x30], ebx
mov dword [rax + 0x34], ebx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x28], rax
mov qword [rcx + 0x108], rbx
mov dword [rcx + 0x114], ebx
mov dword [rcx + 0x110], ebx
mov qword [rcx + 0x128], rbx
mov dword [rcx + 0x134], ebx
mov dword [rcx + 0x130], ebx
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbx
mov qword [rcx + 0x28], rbx
mov qword [rcx + 0x30], rbx
mov qword [rcx + 0x348], rbx
mov dword [rcx + 0x350], ebx
mov dword [rcx + 0x354], ebx
mov qword [rcx + 0x358], rbx
mov dword [rcx + 0x44], ebx
mov qword [rcx + 0x118], rbx
mov dword [rcx + 0x120], ebx
lea rcx, [rsp + 0x24]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebx
jne 0x1000ad1a3
mov rax, qword [0x1000dedd8]
lea rcx, [0x1000dedd8]
cmp rax, rcx
je 0x1000ad1ab
test byte [rax + 0x1c], 1
je 0x1000ad1ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1000dedd8]
lea edx, [rbx + 0x3e]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fb8]
mov r9d, eax
call fcn.100020d8c
jmp 0x1000ad1ab
cmp dword [rsp + 0x24], 6
setae bl
mov dword [rdi + 0x40], ebx
mov rax, rdi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000cd7d0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x1000ae8e0
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x830
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x348]
mov ebx, edx
mov byte [rsp + 0x20], 0
test rcx, rcx
je 0x1000ae922
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
and qword [rdi + 0x348], 0
and dword [rdi + 0x354], 0
and dword [rdi + 0x350], 0
mov edx, ebx
mov rcx, rdi
call fcn.1000aea90
mov ebx, eax
test eax, eax
jns 0x1000ae9a4
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aea21
test byte [rcx + 0x1c], 1
je 0x1000aea21
mov edx, 0x3a
jmp 0x1000aea0e
mov rcx, rdi
call fcn.1000ad550
mov ebx, eax
test eax, eax
js 0x1000aea68
mov r8d, dword [rdi + 0x368]
test r8d, r8d
je 0x1000aea64
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1000afa3c
mov ebx, eax
test eax, eax
js 0x1000aea44
mov rcx, rdi
call fcn.1000ad1d8
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x800
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov rcx, rdi
mov ebx, eax
call fcn.1000ad228
test ebx, ebx
jne 0x1000ae96b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aea21
test byte [rcx + 0x1c], 1
je 0x1000aea21
mov edx, 0x3b
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f38]
mov r9d, ebx
call fcn.100020d8c
mov eax, ebx
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.1000cd7d0
mov rbx, qword [rsp + 0x850]
add rsp, 0x830
pop rdi
ret
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aea21
test byte [rcx + 0x1c], 1
je 0x1000aea21
mov edx, 0x3d
jmp 0x1000aea0e
xor ebx, ebx
jmp 0x1000aea21
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aea21
test byte [rcx + 0x1c], 1
je 0x1000aea21
mov edx, 0x3c
jmp 0x1000aea0e
Function at 0x1000aea90
Capabilities:
Read http header
Receive http response

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x60], 0
mov ebp, edx
mov rdi, rcx
call fcn.1000ad1d8
mov rcx, qword [rdi + 0x10]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, rdi
mov ebx, eax
call fcn.1000ad228
test ebx, ebx
jne 0x1000aeb0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x1000dedd8]
lea rsi, [0x1000dedd8]
cmp rcx, rsi
je 0x1000aece4
test byte [rcx + 0x1c], 1
je 0x1000aece4
mov edx, 0x3e
mov r9d, ebx
jmp 0x1000aeb45
mov rcx, rdi
call fcn.1000ad550
mov ebx, eax
test eax, eax
jns 0x1000aeb5a
mov rcx, qword [0x1000dedd8]
lea rsi, [0x1000dedd8]
cmp rcx, rsi
je 0x1000aece4
test byte [rcx + 0x1c], 1
je 0x1000aece4
mov edx, 0x3f
mov r9d, eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f38]
call fcn.100020d8c
jmp 0x1000aece4
mov rcx, rdi
mov dword [rsp + 0x60], 4
call fcn.1000ad1d8
mov rcx, qword [rdi + 0x10]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
lea r9, [rdi + 0x340]
xor r8d, r8d
mov edx, 0x20000013
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
lea rsi, [0x1000dedd8]
mov ebx, eax
test eax, eax
je 0x1000aec84
test ebp, ebp
je 0x1000aec84
mov rcx, qword [rdi + 0x10]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x4000000b
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 0x10
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ebx, eax
test eax, eax
jne 0x1000aec1d
mov rax, qword [0x1000dedd8]
cmp rax, rsi
je 0x1000aec16
test byte [rax + 0x1c], 1
je 0x1000aec16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1000dedd8]
lea edx, [rbx + 0x40]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f38]
mov r9d, eax
call fcn.100020d8c
mov ebx, 1
jmp 0x1000aec84
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x1000aec68
mov rax, qword [0x1000dedd8]
cmp rax, rsi
je 0x1000aec68
test byte [rax + 0x1c], 1
je 0x1000aec68
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1000dedd8]
lea r8, [0x100002f38]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x41
call fcn.100020d8c
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x358], rax
mov rcx, rdi
call fcn.1000ad228
test ebx, ebx
jne 0x1000aece2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x1000dedd8]
cmp rcx, rsi
je 0x1000aece4
test byte [rcx + 0x1c], 1
je 0x1000aece4
mov eax, dword [rsp + 0x60]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f38]
mov edx, 0x42
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.1000ace8c
jmp 0x1000aece4
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000aecfc
Capabilities:
Read http header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov r12, rdx
mov rbp, rcx
mov ebx, 0x80070057
test r8, r8
je 0x1000aedf8
test r9, r9
je 0x1000aedf8
cmp dword [r9], 2
jb 0x1000aedf8
call fcn.1000ad1d8
mov rcx, qword [rbp + 0x10]
and qword [rsp + 0x28], 0
mov r9, rsi
mov r8, r12
mov edx, 0xffff
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x1000aedb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aedee
test byte [rcx + 0x1c], 1
je 0x1000aedee
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f38]
mov edx, 0x44
mov r9, r12
mov dword [rsp + 0x20], ebx
call fcn.100020b88
jmp 0x1000aedee
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aedec
test byte [rcx + 0x1c], 4
je 0x1000aedec
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f38]
mov edx, 0x45
mov r9, r12
mov qword [rsp + 0x20], rsi
call fcn.100020694
xor ebx, ebx
mov rcx, rbp
call fcn.1000ad228
jmp 0x1000aee26
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aee26
test byte [rcx + 0x1c], 1
je 0x1000aee26
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f38]
mov edx, 0x43
call fcn.100020584
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r12
ret

Function at 0x1000af8b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x1000af911
mov rax, qword [0x1000dedd8]
lea rcx, [0x1000dedd8]
cmp rax, rcx
je 0x1000af911
test byte [rax + 0x1c], 1
je 0x1000af911
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1000dedd8]
lea r8, [0x100002f38]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x7f
call fcn.100020d8c
lea rcx, [rbx + 0x88]
call fcn.1000b0220
mov rcx, qword [rbx]
test rcx, rcx
je 0x1000af92f
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
and qword [rbx], 0
lea rcx, [rbx + 0x88]
call fcn.1000b028c
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1000af954
Function at 0x1000afe88
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor edi, edi
mov rbx, rcx
mov word [rsp + 0x30], di
cmp rcx, rdi
je 0x1000b0048
mov word [rcx], di
mov rdx, rcx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, edi
je 0x1000affe8
cmp word [rbx], di
je 0x1000affe8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000afeef
and eax, 0x10
jne 0x1000aff37
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, edi
jne 0x1000aff37
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aff2f
test byte [rcx + 0x1c], 1
je 0x1000aff2f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fb8]
mov edx, 0x13
mov r9, rbx
call fcn.100020614
mov word [rbx], di
jmp 0x1000b0026
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, edi
jne 0x1000aff95
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, edi
cmovge ebx, eax
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b0044
test byte [rcx + 0x1c], 1
je 0x1000b0044
mov edx, 0x14
jmp 0x1000affcf
lea r8, [rsp + 0x30]
mov edx, 0x104
mov rcx, rbx
call fcn.100045190
cmp eax, edi
mov ebx, eax
jge 0x1000affe4
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b0044
test byte [rcx + 0x1c], 1
je 0x1000b0044
mov edx, 0x15
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fb8]
mov r9d, ebx
call fcn.100020d8c
jmp 0x1000b0044
mov ebx, edi
jmp 0x1000b0044
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b0026
test byte [rcx + 0x1c], 1
je 0x1000b0026
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1000dedd8]
lea r8, [0x100002fb8]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x12
call fcn.100020d8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, edi
cmovge ebx, eax
mov eax, ebx
jmp 0x1000b007b
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b0076
test byte [rcx + 0x1c], 1
je 0x1000b0076
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fb8]
mov edx, 0x11
call fcn.100020584
mov eax, 0x80070057
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000cd7d0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x1000b00a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov edi, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbx
mov ecx, edi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000b0123
test byte [rcx + 0x1c], 4
je 0x1000b0123
cmp eax, esi
jb 0x1000b0103
sub eax, esi
jmp 0x1000b0107
sub eax, esi
dec eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fb8]
mov edx, 0x18
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.100020b88
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1000b2118
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov ebx, 0x80070057
test rcx, rcx
jne 0x1000b215d
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b224f
test byte [rcx + 0x1c], 1
je 0x1000b224f
lea edx, [rdi + 0xc]
jmp 0x1000b2188
test rdx, rdx
jne 0x1000b219d
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b224f
test byte [rcx + 0x1c], 1
je 0x1000b224f
mov edx, 0xd
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
call fcn.100020584
jmp 0x1000b224f
lea r8, [0x10000cfa4]
mov edx, 0x104
call fcn.100091e8c
mov ebx, eax
test eax, eax
jns 0x1000b21d8
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b224f
test byte [rcx + 0x1c], 1
je 0x1000b224f
mov edx, 0xe
jmp 0x1000b220c
mov r8, rsi
mov edx, 0x104
mov rcx, rdi
call fcn.100091e8c
mov ebx, eax
test eax, eax
jns 0x1000b2221
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b224f
test byte [rcx + 0x1c], 1
je 0x1000b224f
mov edx, 0xf
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
mov r9d, ebx
call fcn.100020d8c
jmp 0x1000b224f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000b224d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000b224d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1000b224f
xor ebx, ebx
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000b8444
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rdi, rcx
add rcx, 0x40
mov ebp, r8d
mov ebx, edx
mov esi, 1
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rdi + 0x38]
test rax, rax
je 0x1000b8497
cmp qword [rax + 0x18], 0
je 0x1000b8497
cmp qword [rax], 0
je 0x1000b8497
mov rdx, qword [rax]
mov r8d, ebx
mov ecx, ebp
call qword [rax + 0x18]
mov esi, eax
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1000b84ca
mov rcx, qword [rcx]
test rcx, rcx
je 0x1000b84ca
test ebp, ebp
js 0x1000b84ca
cmp ebx, 0xc8
je 0x1000b84c4
cmp ebx, 0x193
je 0x1000b84c4
cmp ebx, 0xc9
jne 0x1000b84ca
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r12
ret