joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055e60
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
mov rax, qword [0x1400c4a20]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor edi, edi
mov r14, rcx
xor edx, edx
mov esi, edi
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140056036
xor edx, edx
mov dword [rsp + 0x60], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x64]
call main
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140055ef9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x68], eax
je 0x140055ef2
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140055ed2
jmp 0x140055ef9
mov esi, dword [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140056036
mov r8d, esi
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x30], rdi
mov ecx, 0x400
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov ebp, edi
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140055f59
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140056036
lea rax, [rsp + 0x40]
mov rcx, rbx
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x140055fd9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x140055fd4
mov eax, dword [rsp + 0x30]
mov edx, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x3c]
shl rdx, 0x20
or rdx, rax
shl rcx, 0x20
mov eax, dword [rsp + 0x38]
or rcx, rax
mov eax, 1
cmp rcx, rdx
cmovb ebp, eax
test rbx, rbx
je 0x140055fe2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x140056036
cmp qword [0x1400cbbc0], rdi
jne 0x140056028
lea rcx, [0x1400a8190]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140056036
lea rdx, str.ProcessIdToSessionId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400cbbc0], rax
setne dil
test edi, edi
je 0x140056036
test rax, rax
je 0x140056036
call fcn.140055d40
mov rdx, r14
mov ecx, esi
call rax
jmp 0x140056038
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140080bf0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400561a0
Capabilities:
Get common file path
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x1400c4a20]
xor rax, rsp
mov qword [rbp + 0x580], rax
xor edi, edi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], edi
call fcn.140055e60
test eax, eax
je 0x14005636a
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x418
call main
mov eax, dword [rsp + 0x40]
lea rcx, [rbp + 0x370]
mov edx, 0x104
mov dword [rsp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, 2
jb 0x14005636a
cmp word [rbp + 0x372], 0x3a
jne 0x14005636a
mov ecx, eax
lea rax, [rcx + 0xd]
cmp rax, 0x105
jae 0x14005636a
add rcx, rcx
cmp rcx, 0x20a
jae 0x140056390
mov word [rbp + rcx + 0x370], di
lea rdx, str.explorer.exe
lea rcx, [rbp + 0x370]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rax, [rbp + 0x370]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], di
jne 0x140056272
mov r8d, 0x208
mov word [rbp + 0x374], di
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x370]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, eax
test rax, rax
je 0x14005636a
add rax, 0xfffffffffffffffe
add rax, rbx
cmp rax, 0x209
jae 0x14005636a
lea rdx, [rbp + 0x376]
lea rcx, [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x50]
lea rcx, [0x140056060]
call fcn.140055d90
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x14005636a
xor edx, edx
mov qword [rsp + 0x30], rdi
mov ecx, 0x400
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140056353
lea r8, [rsp + 0x30]
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14005634a
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140056363
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x38]
jmp 0x14005636c
xor eax, eax
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.140080bf0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.140080fe4
int3
Function at 0x140056c00
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400c4a20]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov r14, rcx
xor r15d, r15d
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
lea rsi, [rdx + 0x10]
mov rdx, qword [rsi]
lea rcx, [rbp - 0x30]
call fcn.140057840
cmp qword [rdi + 0x18], 8
jb 0x140056c5c
mov rbx, qword [rdi]
mov rcx, rbx
mov rdi, rbx
jmp 0x140056c62
mov rbx, rdi
mov rcx, rdi
mov rax, qword [rsi]
lea rsi, [rcx + rax*2]
cmp rdi, rsi
je 0x140056cfc
movzx r9d, word [rbx]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
cmp rcx, rdx
jae 0x140056ca5
lea rax, [rcx + 1]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x30]
cmp rdx, 8
cmovae rax, qword [rbp - 0x30]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x140056cae
lea rcx, [rbp - 0x30]
call fcn.140055180
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x140056cbd
cmp ax, 0x2f
jne 0x140056cf0
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140056cf0
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140056d32
add rbx, 2
cmp rbx, rsi
jmp 0x140056c6c
mov ebx, r15d
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140056d59
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140056d59
lea rbx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rbx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, rbx
mov rcx, r14
call fcn.1400584e0
mov ebx, 7
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140056d95
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056d90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056dc8
call fcn.1400222c0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140080bf0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140065e1c
nop
int3
Function at 0x14005ca30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r10, [0x1400c8940]
xor edx, edx
mov r8, r10
nop dword [rax]
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x14005ca40
lea rax, [0x1400c8944]
mov r9d, 0x2c0
nop dword [rax]
mov r8d, dword [rax - 4]
lea rax, [rax + 0x10]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
mov dword [rax + 0x3ec], r8d
mov r8d, dword [rax - 0x10]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
mov dword [rax + 0x3f0], r8d
mov r8d, dword [rax - 0xc]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
mov dword [rax + 0x3f4], r8d
mov r8d, dword [rax - 8]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
mov dword [rax + 0x3f8], r8d
sub r9, 1
jne 0x14005caf0
ret
Function at 0x14005cb60
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14005cb60
mov qword [rsp + 0x20], rbp
push rsi
push r15
mov qword [rsp + 0x28], r14
mov r9, r8
lea r15, [0x1400c8940]
mov rsi, rdx
test r8, r8
je 0x14005cba3
nop
test sil, 3
je 0x14005cba3
movzx r8d, byte [rsi]
mov eax, ecx
xor r8, rax
shr ecx, 8
movzx eax, r8b
inc rsi
xor ecx, dword [r15 + rax*4]
sub r9, 1
jne 0x14005cb80
lea r14, [rsi + r9]
mov rbp, r14
cmp r9, 0xc
jb 0x14005ccaa
mov qword [rsp + 0x18], rbx
sub r14, 0xc
mov qword [rsp + 0x20], rdi
nop dword [rax]
nop word [rax + rax]
xor ecx, dword [rsi]
mov r10d, dword [rsi + 4]
mov ebx, dword [rsi + 8]
mov eax, r10d
shr rax, 0x10
mov r9d, r10d
movzx r8d, al
add rsi, 0xc
shr r9, 0x18
mov eax, r10d
shr rax, 8
movzx edx, al
mov edi, dword [r15 + r8*4 + 0x1400]
mov r11d, ecx
movzx eax, r10b
mov r10d, ebx
xor edi, dword [r15 + rdx*4 + 0x1800]
xor edi, dword [r15 + r9*4 + 0x1000]
shr r10, 0x18
xor edi, dword [r15 + rax*4 + 0x1c00]
mov eax, ebx
shr rax, 0x10
movzx r8d, al
mov eax, ebx
shr rax, 8
movzx edx, al
mov eax, ecx
mov r9d, dword [r15 + r8*4 + 0x400]
shr rax, 0x10
xor r9d, dword [r15 + rdx*4 + 0x800]
movzx edx, al
mov eax, ecx
shr rax, 8
shr r11, 0x18
xor r9d, dword [r15 + rdx*4 + 0x2400]
movzx edx, al
movzx eax, cl
xor r9d, dword [r15 + rdx*4 + 0x2800]
xor r9d, dword [r15 + r10*4]
xor r9d, dword [r15 + r11*4 + 0x2000]
mov ecx, r9d
xor ecx, dword [r15 + rax*4 + 0x2c00]
movzx eax, bl
xor ecx, dword [r15 + rax*4 + 0xc00]
xor ecx, edi
cmp rsi, r14
jbe 0x14005cbd0
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov r14, qword [rsp + 0x28]
cmp rsi, rbp
jae 0x14005ccda
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rsi]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
inc rsi
xor ecx, dword [r15 + rax*4]
cmp rsi, rbp
jb 0x14005ccc0
mov rbp, qword [rsp + 0x30]
mov eax, ecx
pop r15
pop rsi
ret

Function at 0x14005db10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1400c4a20]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [r8]
xor ebp, ebp
mov qword [r8], rbp
mov rdi, r8
mov rsi, rdx
mov r14, rcx
test rbx, rbx
je 0x14005db8e
mov r15d, 0x400000
nop dword [rax + rax]
mov rcx, qword [r14]
lea r9, [rsp + 0x30]
mov r8d, ebx
mov dword [rsp + 0x30], ebp
cmp rbx, r15
mov qword [rsp + 0x20], rbp
mov rdx, rsi
cmova r8d, r15d
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x30]
add qword [rdi], rdx
add rsi, rdx
sub rbx, rdx
test eax, eax
je 0x14005dbb1
test edx, edx
je 0x14005db8e
test rbx, rbx
jne 0x14005db50
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140080bf0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14005db90
Function at 0x1400837c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1400c4a20]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140083804
movzx eax, r14w
jmp 0x14008393a
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140083840
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140083840
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14008393a
cmp qword [rcx + 0x80], r14
je 0x140083937
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14008387e
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400838a7
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140072df4
cmp ax, di
je 0x140083937
movzx edi, si
jmp 0x140083937
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [case.0x140025751.0]
test eax, eax
je 0x1400838fc
sub eax, 1
je 0x1400838fc
cmp eax, 2
jne 0x140083937
movzx ecx, word [rbp + 7]
jmp 0x14008388a
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x140083926
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.140067610
cmp r14, rax
jne 0x140083937
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x14008393a
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140080bf0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14008de20
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1400c4a20]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x14008db5f
call fcn.140066ce0
mov dword [rax], 0x16
call fcn.140065dfc
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140080bf0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test rcx, rcx
je 0x14008db26
mov dword [rsp + 0x28], esi
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14008dbcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x14008dba0
cmp eax, 3
jbe 0x14008dbbd
cmp eax, 8
je 0x14008dbad
cmp eax, 0x12
je 0x14008dbbd
call fcn.140066ce0
mov dword [rax], 0x16
jmp 0x14008db36
call fcn.140066ce0
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
jmp 0x14008db36
call fcn.140066ce0
mov dword [rax], 2
jmp 0x14008db36
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.14008dd68
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.14008dd68
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.14008dd68
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.140066840
test eax, eax
jne 0x14008dc2b
mov rax, rdi
jmp 0x14008db3a
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140065e4c
int3
jmp 0x14008daf8
Function at 0x14008de28
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x1400c4a20]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edi, edi
mov rbx, rdx
test rcx, rcx
jne 0x14008dc9d
call fcn.140066ce0
mov dword [rax], 0x16
call fcn.140065dfc
or eax, 0xffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140080bf0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret
cmp rcx, 0xffffffffffffffff
je 0x14008dc69
test rbx, rbx
je 0x14008dc69
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14008dcf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x14008dcd1
cmp eax, 3
jbe 0x14008dceb
cmp eax, 8
je 0x14008dcde
cmp eax, 0x12
je 0x14008dceb
call fcn.140066ce0
mov dword [rax], 0x16
jmp 0x14008dc79
call fcn.140066ce0
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
jmp 0x14008dc79
call fcn.140066ce0
mov dword [rax], 2
jmp 0x14008dc79
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, edi
mov dword [rbx], eax
call fcn.14008dd68
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.14008dd68
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.14008dd68
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.140066840
test eax, eax
je 0x14008dc7c
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140065e4c
int3
jmp 0x14008dc40
Function at 0x1400207e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
lea rdx, str._AUTOHOTKEY_SCRIPT_
mov r8d, 0xa
xor ecx, ecx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400208f1
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x28], eax
test eax, eax
je 0x1400208f1
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400208f1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400208f1
mov ecx, 0x58
call fcn.1400cbd40
test rax, rax
je 0x14002088a
mov rcx, rax
call fcn.14001e550
mov rbx, rax
jmp 0x14002088c
xor ebx, ebx
mov dword [rsp + 0x50], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rax, qword [rbx]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsi], rbx
mov dword [rbx + 0xc], 0
call qword [rax + VariantCopy]
test al, al
je 0x1400208c8
lea rdx, [rsp + 0x50]
mov r8d, 0xfde9
mov rcx, rbx
call fcn.1400aab70
mov rax, qword [0x14011bd50]
inc dword [0x14011a468]
mov qword [0x140118628], rax
mov eax, 3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rdx, str.Could_not_extract_script_from_EXE.
lea rcx, [0x14011b1d0]
mov r8, rdi
call fcn.140040740
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140009670
Capabilities:
Create directory
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [0x140033010]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x140025028]
xor esi, esi
lea r9, [rsp + 0x20]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400096c6
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.14000aeb8
cmp rax, 0x105
jb 0x1400096dd
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140016030
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8d, 0x105
mov rcx, rdi
mov rdx, rbx
call fcn.14000b080
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.Mozilla_Maintenance_Service
mov rcx, rdi
call int.1400246c0
test eax, eax
je 0x1400096c6
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000972a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400096c6
lea rdx, str.UpdateLogs
mov rcx, rdi
call int.1400246c0
test eax, eax
je 0x1400096c6
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000975f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400096c6
mov esi, 1
jmp 0x1400096c6
Function at 0x14000a070
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov ebp, edx
mov rbx, rcx
mov rax, qword [0x140033010]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor edi, edi
lea rsi, [rsp + 0x40]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.14000cd10
mov rcx, rsi
call fcn.140009670
test eax, eax
je 0x14000a0e5
xor edi, edi
lea rsi, [rsp + 0x250]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.14000cd10
lea rdx, str..status
mov rcx, rbx
mov r8, rsi
call fcn.140009770
test eax, eax
jne 0x14000a103
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140016030
mov eax, edi
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x250]
call int.1400246c0
test eax, eax
je 0x14000a0e5
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor edi, edi
lea rcx, [rsp + 0x40]
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000a0e5
mov rbx, rax
lea rsi, [rsp + 0x250]
mov rcx, rsi
mov r8d, ebp
call fcn.140024650
mov rcx, rsi
call fcn.1400141f0
mov rdi, rax
mov qword [rsp + 0x20], 0
lea rbp, [rsp + 0x3c]
mov rcx, rbx
mov rdx, rsi
mov r8d, edi
mov r9, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
setne al
cmp dword [rbp], edi
sete cl
and cl, al
movzx edi, cl
jmp 0x14000a0e5

Function at 0x14000a1c0
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rax, qword [0x140033010]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov esi, 0x102
test edx, edx
je 0x14000a29f
mov r15d, edx
mov rbx, rcx
xor ebp, ebp
lea r12, [rsp + 0x54]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
lea r13, [rsp + 0x28]
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x14000a25c
mov rdi, rax
mov dword [rsp + 0x28], 0x238
mov rcx, rax
mov rdx, r13
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000a266
mov rcx, rbx
mov rdx, r12
call fcn.140012614
test eax, eax
je 0x14000a270
mov rcx, rdi
mov rdx, r13
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000a237
mov esi, 0x490
jmp 0x14000a272
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14000a27b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14000a272
xor esi, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x490
je 0x14000a29d
mov ecx, 0x3e8
call r14
inc ebp
cmp ebp, r15d
jne 0x14000a20b
mov esi, 0x102
jmp 0x14000a29f
xor esi, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140016030
mov eax, esi
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret