joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ee40
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rsi, rcx
call fcn.14001e7d0
mov rdi, rax
lea rbx, [rsi + 0xa8]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001efe5
nop dword [rax + rax]
mov r8d, dword [rdi + 0x30]
sub r8d, dword [rdi + 0x28]
xor r9d, r9d
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.WS2_32.dll_send]
mov ebp, eax
test eax, eax
jle 0x14001ef07
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [rsi + 0x208], ebp
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r9, qword [rsi]
mov r8d, ebp
mov rdx, qword [rdi + 0x28]
mov rcx, rsi
call qword [r9 + 0x118]
cmp eax, 2
jne 0x14001ef00
mov rdx, qword [rsi + 0x38]
lea rcx, str._C_CNNID:__Iu__OnSend___event_should_not_return_HR_ERROR____n
call fcn.14001c3a0
mov rbx, qword [rsp + 0x28]
jmp 0x14001ef0c
cmp eax, 0xffffffff
je 0x14001ef4e
lea rcx, [rbx + 0x30]
mov rdx, rdi
call fcn.140018a20
test eax, eax
jne 0x14001ef24
mov rcx, rdi
call fcn.14001c380
mov rcx, rsi
call fcn.14001e7d0
mov rdi, rax
lea rbx, [rsi + 0xa8]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x14001ee90
jmp 0x14001efe5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14001efb1
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 0x1d8]
test rax, rax
je 0x14001ef85
mov qword [rax + 0x10], rdi
mov rax, qword [rsi + 0x1d8]
mov qword [rdi + 8], rax
jmp 0x14001ef94
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], rax
mov qword [rsi + 0x1e0], rdi
mov qword [rsi + 0x1d8], rdi
inc dword [rsi + 0x1d0]
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
jmp 0x14001f002
mov dword [rsi + 0x18], 1
mov dword [rsi + 0x1c], 3
mov dword [rsi + 0x20], eax
mov dword [rsi + 0x24], 1
lea rcx, [rbx + 0x30]
mov rdx, rdi
call fcn.140018a20
test eax, eax
jne 0x14001efe1
mov rcx, rdi
call fcn.14001c380
xor eax, eax
jmp 0x14001f007
test rdi, rdi
je 0x14001f002
lea rcx, [rbx + 0x30]
mov rdx, rdi
call fcn.140018a20
test eax, eax
jne 0x14001f002
mov rcx, rdi
call fcn.14001c380
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret

Function at 0x14001f9d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rax, [rcx + 0x60]
mov rbx, rcx
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x14001f580]
xor edi, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call fcn.140021d18
test rax, rax
mov qword [rbx + 0x58], rax
mov rbx, qword [rsp + 0x40]
setne dil
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x14002446c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400242dc
Function at 0x14002ba5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x14002ba86
call fcn.1400262cc
and dword [rax], 0
call fcn.1400262ac
mov ebx, reloc.WS2_32.dll_shutdown
mov dword [rax], ebx
call fcn.140026244
mov eax, ebx
jmp 0x14002bad6
test edx, 0xfffffff9
jne 0x14002ba69
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002baaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400262ec
call fcn.1400262ac
mov eax, dword [rax]
jmp 0x14002bad6
test al, 0x10
jne 0x14002bad4
test al, 1
je 0x14002bad4
test bl, 2
je 0x14002bad4
call fcn.1400262cc
mov dword [rax], 5
call fcn.1400262ac
mov dword [rax], ntohs
jmp 0x14002baa6
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14002cd6b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140056610]
jne 0x140024fda
rol rcx, 0x10
test cx, 0xffff
jne 0x140024fd6
repz ret
ror rcx, 0x10
jmp 0x14002ccc4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14005a820]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14005a918]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14002cd49
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14005a820]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14002cd6b
mov rax, qword [rsp + 0x88]
mov qword [0x14005a918], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14005a8b8], rax
mov rax, qword [0x14005a918]
mov qword [0x14005a790], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14005a8a0], rax
mov dword [0x14005a780], 0xc0000409
mov dword [0x14005a784], 1
mov rax, qword [0x140056610]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140056618]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14005a818], eax
mov ecx, 1
call fcn.1400311bc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140048110]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14005a818], 0
jne 0x14002cdf2
mov ecx, 1
call fcn.1400311bc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140032340
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140056610]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140027964
xor ebx, ebx
cmp qword [0x14005ad68], rbx
mov rdi, rax
jne 0x140032453
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14003252a
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003252a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14005ad68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14005ad70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14005ad78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14005ad88], rax
test rax, rax
je 0x14003244a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14005ad80], rax
jmp 0x14003245a
mov rax, qword [0x14005ad80]
jmp 0x140032461
mov rax, qword [0x14005ad80]
mov r11, qword [0x14005ad88]
cmp rax, rdi
je 0x1400324c8
cmp r11, rdi
je 0x1400324c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14005ad88]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400324c8
test rax, rax
je 0x1400324c8
call rsi
test rax, rax
je 0x1400324c2
lea rcx, [rsp + 0x30]
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400324c2
test byte [rsp + 0x40], 1
jne 0x1400324c8
bts ebp, 0x15
jmp 0x140032508
mov rcx, qword [0x14005ad70]
cmp rcx, rdi
je 0x140032508
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140032508
call rax
mov rbx, rax
test rax, rax
je 0x140032508
mov rcx, qword [0x14005ad78]
cmp rcx, rdi
je 0x140032508
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140032508
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14005ad68]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14003252a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14003252c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140024fc0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1407c3058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407c31df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407c3089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c306f
add dl, dl
jne 0x1407c3096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c30f6
xor eax, eax
add dl, dl
jne 0x1407c30a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c31ad
add dl, dl
jne 0x1407c30b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c30c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c30d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c30dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407c30ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407c307e
mov eax, 1
add dl, dl
jne 0x1407c3106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c3113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c30fb
sub eax, ebx
mov ebx, 1
jne 0x1407c314c
mov ecx, 1
add dl, dl
jne 0x1407c312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407c313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c3123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407c3168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407c3175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c315d
cmp eax, 0x7d00
jae 0x1407c319b
cmp eax, 0x500
jb 0x1407c3196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c307e
cmp eax, 0x7f
ja 0x1407c319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407c31d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407c307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400111d1
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140014700
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x278]
mov rax, qword [0x140022040]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x1400280fc]
call fcn.1400114b0
mov dword [rbp + 0x10], 0x130
xor edx, edx
mov ecx, 2
call fcn.14001125d
mov qword [rbp + 0x158], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x158]
call fcn.140011429
test eax, eax
je 0x1400147b2
mov rdx, qword [rbp + 0x250]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x14001479e
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x18]
jmp 0x1400147c1
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x158]
call fcn.1400114ba
test eax, eax
jne 0x140014777
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ed20]
call fcn.140011438
mov rax, rdi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.14001127b
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret

Function at 0x1400112d5
Capabilities:
Terminate process

Disassembly:
jmp 0x140017380
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011375
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400186d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400186f0
xor al, al
jmp 0x140018771
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018703
xor al, al
jmp 0x140018771
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001872d
xor al, al
jmp 0x140018771
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018741
xor al, al
jmp 0x140018771
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018753
xor al, al
jmp 0x140018771
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001876f
xor al, al
jmp 0x140018771
mov al, 1
add rsp, 0x38
ret
Function at 0x14000c3ac
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x14001a710]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r14, r8
xor r15d, r15d
mov qword [r8], r15
mov r9d, 0x104
lea rdx, [rsp + 0x30]
lea rax, [rsp + 0x30]
sub rcx, rax
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x14000c41d
movzx eax, word [rcx + rdx]
test ax, ax
je 0x14000c41d
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x14000c3fb
lea rax, [rdx - 2]
test r9, r9
cmovne rax, rdx
mov word [rax], r15w
lea r8, [0x140014f18]
lea rcx, [rsp + 0x30]
call fcn.140006fc8
lea r8, [rsp + 0x30]
xor edx, edx
mov esi, 0x1f0003
mov ecx, esi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000c568
mov dword [rsp + 0x24], r15d
mov dword [rsp + 0x20], r15d
lea rdx, [rsp + 0x24]
mov rcx, rax
call fcn.140009c80
mov edi, eax
test eax, eax
jns 0x14000c4ac
mov rcx, qword [rbp + 0x168]
mov r9d, eax
lea r8, [0x140014dc4]
mov edx, 0xcf
call fcn.140006fa4
nop
mov rcx, rbx
call fcn.140008fa0
nop
mov eax, edi
jmp 0x14000c58e
lea r8, [0x140014f20]
lea rcx, [rsp + 0x30]
call fcn.140006fc8
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, esi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14000c547
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140009c80
mov esi, eax
test eax, eax
jns 0x14000c51f
mov rcx, qword [rbp + 0x168]
mov r9d, eax
lea r8, [0x140014dc4]
mov edx, 0xd7
call fcn.140006fa4
nop
mov rcx, rdi
call fcn.140008fa0
nop
mov rcx, rbx
call fcn.140008fa0
nop
mov eax, esi
jmp 0x14000c58e
mov rcx, rdi
call fcn.140008fa0
nop
movsxd rcx, dword [rsp + 0x20]
shl rcx, 0x1f
movsxd rax, dword [rsp + 0x24]
or rax, rcx
mov qword [r14], rax
mov rcx, rbx
call fcn.140008fa0
nop
jmp 0x14000c579
mov rcx, qword [rbp + 0x168]
mov edx, 0xd5
call fcn.140006f84
mov edi, eax
mov rcx, rbx
call fcn.140008fa0
nop
jmp 0x14000c4a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
jne 0x14000c57d
xor eax, eax
jmp 0x14000c58e
mov rcx, qword [rbp + 0x168]
mov edx, 0xc9
call fcn.140006f84
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140001600
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000ece4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rdx]
mov rdi, r8
mov rsi, rdx
mov r8d, ebx
mov rdx, rdi
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
xor edx, edx
mov r9d, eax
test eax, eax
jne 0x14000ed5e
call fcn.140011b58
mov ebx, eax
mov rcx, qword [0x14001a028]
lea rax, [0x14001a028]
cmp rcx, rax
je 0x14000ed5a
test byte [rcx + 0x1c], 1
je 0x14000ed5a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015110]
mov edx, 0x38
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.1400072bc
mov eax, ebx
jmp 0x14000ed80
cmp r9d, ebx
ja 0x14000ed74
lea eax, [r9 - 1]
cmp word [rdi + rax*2], dx
je 0x14000ed7b
mov eax, 0x8000ffff
jmp 0x14000ed80
test ebx, ebx
je 0x14000ed7b
mov word [rdi], dx
mov qword [rsi], r9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000ed9c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x14000ee0b
call fcn.140011b58
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x14000ee07
mov rcx, qword [0x14001a028]
lea rax, [0x14001a028]
cmp rcx, rax
je 0x14000ee07
test byte [rcx + 0x1c], 1
je 0x14000ee07
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015110]
mov edx, 0x3d
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1400072bc
mov eax, ebx
jmp 0x14000ee0f
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000eefc
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14000ef27
xor eax, eax
jmp 0x14000efc8
call fcn.140011b58
mov ebx, eax
cmp eax, 0x800700b7
je 0x14000ef6e
mov rcx, qword [0x14001a028]
lea rdx, [0x14001a028]
cmp rcx, rdx
je 0x14000ef6a
test byte [rcx + 0x1c], 1
je 0x14000ef6a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015110]
mov edx, 0x2d
mov dword [rsp + 0x20], eax
mov r9, rdi
call fcn.1400072bc
mov eax, ebx
jmp 0x14000efc8
and dword [rsp + 0x48], 0
lea rcx, [rsp + 0x48]
mov rdx, rdi
call fcn.14000ed9c
test eax, eax
js 0x14000efc8
test byte [rsp + 0x48], 0x10
jne 0x14000efc3
mov rcx, qword [0x14001a028]
lea rdx, [0x14001a028]
cmp rcx, rdx
je 0x14000efbc
test byte [rcx + 0x1c], 1
je 0x14000efbc
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015110]
mov edx, 0x37
mov r9, rdi
call fcn.140005700
mov eax, 0x800700b7
jmp 0x14000efc8
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000ff1c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, qword [r9]
mov rdi, r9
mov eax, r14d
mov r15, r8
mov dword [rsp + 0x68], eax
mov rbp, rdx
cmp rax, r14
je 0x14000ff56
mov eax, 0x80070057
jmp 0x140010024
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov r9, r15
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14000ff8b
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x14000ffc6
test rsi, rsi
je 0x14000ffa7
mov eax, dword [rsp + 0x68]
cmp rax, qword [rdi]
jbe 0x14000ffa7
mov qword [rdi], rax
mov eax, 0x800700ea
jmp 0x140010024
mov eax, dword [rsp + 0x68]
mov r9, rdi
mov r8d, dword [r15]
mov rdx, r14
mov rcx, rbp
mov qword [rdi], rax
mov qword [rsp + 0x20], rsi
call fcn.1400106c8
jmp 0x140010024
mov eax, 0x80070002
cmp ebx, eax
je 0x140010024
mov eax, 0x800700ea
cmp ebx, eax
je 0x140010011
mov rcx, qword [0x14001a028]
lea rax, [0x14001a028]
cmp rcx, rax
je 0x14001000d
test byte [rcx + 0x1c], 1
je 0x14001000d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140015120]
mov edx, 0x15
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.1400072bc
mov eax, ebx
jmp 0x140010024
mov ecx, dword [rsp + 0x68]
cmp qword [rdi], rcx
jb 0x140010021
mov eax, 0x8000ffff
jmp 0x140010024
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140012110
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and qword [rdx], 0
lea rbp, [rcx + 0x28]
mov r14, rdx
mov rsi, rcx
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140012164
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14001215d
call fcn.140011b58
mov edi, eax
cmp eax, 0x80070012
jmp 0x1400121f1
xor edi, edi
jmp 0x1400121f3
mov r9, qword [rsi + 0x20]
lea rdx, str._ws_ws
mov r8, qword [rsi + 0x18]
lea rcx, [rsp + 0x40]
and qword [rsp + 0x40], 0
call fcn.14000fa24
mov ebx, eax
test eax, eax
js 0x14001221b
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1400121ad
cmp rcx, 0xffffffffffffffff
je 0x1400121a8
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
and qword [rsi + 0x10], 0
mov rbx, qword [rsp + 0x40]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
jne 0x1400121d8
call fcn.140011b58
mov edi, eax
add eax, 0x7ff8fffe
jmp 0x1400121de
mov qword [rsi + 0x10], rax
xor edi, edi
test rbx, rbx
je 0x1400121eb
mov rcx, rbx
call fcn.14000166c
cmp edi, 0x80070012
je 0x140012213
test edi, edi
js 0x14001220f
test byte [rsi + 0x280], 2
je 0x14001220a
test byte [rbp], 0x10
jne 0x140012130
mov qword [r14], rbp
jmp 0x140012217
mov eax, edi
jmp 0x14001222c
and qword [r14], 0
xor eax, eax
jmp 0x14001222c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001222a
call fcn.14000166c
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140001041
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x1400032e0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
lea rcx, [0x140017300]
call fcn.1400012c1
mov qword [rbp + 8], 0xffffffffffffffff
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14000337b
xor eax, eax
jmp 0x14000344b
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
mov qword [rbp + 0x138], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rbp + 0x138]
mov r8, rcx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x68], rax
mov eax, dword [rbp + 0x24]
mov r8d, eax
xor edx, edx
mov rcx, qword [rbp + 0x68]
call sub.VCRUNTIME140D.dll_memset
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x44]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140003403
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x160]
lea rcx, str.____Error_Rading_File__s:__d
call fcn.140001159
mov rax, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x68]
mov qword [rax], rcx
mov rax, qword [rbp + 0x170]
mov ecx, dword [rbp + 0x44]
mov dword [rax], ecx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x168]
cmp qword [rax], 0
je 0x140003442
mov rax, qword [rbp + 0x170]
mov eax, dword [rax]
test rax, rax
jne 0x140003446
xor eax, eax
jmp 0x14000344b
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14000ecd0]
call fcn.140001262
mov rax, rdi
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret