joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140037430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140053040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x140037470
cmp al, 0x25
jne 0x140037464
cmp byte [r8 + 1], al
jne 0x140037470
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x140037457
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x1400375da
cmp byte [r8 + 1], dl
je 0x1400375da
lea r11, [rsp + 0x20]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x1400374ad
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x1400374d5
sub dl, 0x61
cmp dl, 0x19
ja 0x1400374c7
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x1400374d5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x140037490
jmp 0x1400374d8
inc r9
cmp r8, r9
jae 0x14003750f
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x140037504
bt rdx, rax
jb 0x14003750a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x1400374f0
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.1400026b0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x140037548
nop
inc rcx
cmp byte [rcx], 0x20
je 0x140037540
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400375c8
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14003756a
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x140037578
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x1400375b6
movss xmm2, dword [0x14004ba28]
nop
cmp al, 0x39
ja 0x1400375b6
movzx eax, al
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x140037590
cmp r9b, 0x2d
jne 0x1400375d5
xorps xmm1, xmmword [0x14004bbf0]
movaps xmm0, xmm1
jmp 0x1400375dd
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400375dd
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140043a60
add rsp, 0x90
pop rbx
ret
Function at 0x140037600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140053040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x140037640
cmp al, 0x25
jne 0x140037634
cmp byte [r8 + 1], al
jne 0x140037640
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x140037627
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x1400377a4
cmp byte [r8 + 1], dl
je 0x1400377a4
lea r11, [rsp + 0x20]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14003767d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x1400376a5
sub dl, 0x61
cmp dl, 0x19
ja 0x140037697
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x1400376a5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x140037660
jmp 0x1400376a8
inc r9
cmp r8, r9
jae 0x1400376df
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x1400376d4
bt rdx, rax
jb 0x1400376da
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x1400376c0
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.1400026b0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x140037718
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x140037710
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x140037796
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14003773a
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x140037748
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x140037784
movsd xmm2, qword [0x14004b9c8]
nop
cmp al, 0x39
ja 0x140037784
movzx eax, al
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x140037760
cmp r9b, 0x2d
jne 0x14003779f
xorps xmm1, xmmword [0x14004bbe0]
movaps xmm0, xmm1
jmp 0x1400377a7
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400377a7
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140043a60
add rsp, 0x90
pop rbx
ret
Function at 0x140037ba0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140053040]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edi, edi
xor edx, edx
mov ebx, edi
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140037c36
nop
lea rdx, str.Overwatch.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140037c24
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jle 0x140037c24
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140037c00
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140043a60
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140044670
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400446ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400446ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400446ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400446ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400446ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400446bc
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xe0], rax
lea rbx, [0x14001ad50]
mov r8d, 0x800
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001114
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, str.TinyTeacher.exe
mov rdx, rbx
lea rcx, [0x14001bd50]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
xor eax, eax
lea rcx, [0x14001bd50]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x140001114
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x68]
jmp 0x140001119
mov eax, 1
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140001150
add rsp, 0xf0
pop rbx
ret

Function at 0x140001a4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a96
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a98
xor al, al
add rsp, 0x28
ret

Function at 0x140006094
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005e90
Function at 0x140008af0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140008b77
mov rsi, rbx
cmp word [rax], bp
je 0x140008b36
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140008b20
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140008b1c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140009510
mov rdi, rax
test rax, rax
je 0x140008b64
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000e310
mov rbp, rdi
xor ecx, ecx
call fcn.1400077b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140003e10
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edi, edi
mov rbx, rax
movzx eax, word [rax]
lea r15d, [rdi + 0x20]
cmp ax, 0x22
jne 0x140003e64
mov rcx, rbx
add rbx, 2
movzx eax, word [rbx]
cmp ax, 0x22
je 0x140003e57
test ax, ax
je 0x140003e7e
jmp 0x140003e40
lea rbx, [rcx + 4]
jmp 0x140003e76
add rbx, 2
movzx eax, word [rbx]
cmp ax, r15w
ja 0x140003e5d
jmp 0x140003e79
cmp ax, r15w
ja 0x140003e7e
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x140003e6c
mov qword [0x140230f28], rdi
mov esi, edi
test rbx, rbx
je 0x140003f72
movzx edx, word [0x1401e3bb0]
lea r14, [0x1401e3bb0]
movzx eax, word [rbx]
test ax, ax
je 0x140003f72
movzx ecx, ax
cmp ax, 0x2d
je 0x140003ec8
cmp ax, 0x2f
je 0x140003ec8
add rbx, 2
movzx eax, word [rbx]
movzx ecx, ax
test ax, ax
jne 0x140003eaa
test cx, cx
je 0x140003e9e
add rbx, 2
mov ebp, edi
mov rcx, rdi
test dx, dx
je 0x140003ef6
movzx eax, dx
cmp ax, word [rbx]
je 0x140003ef6
inc rcx
inc ebp
lea rax, [rcx + rcx*2]
movzx eax, word [r14 + rax*8]
test ax, ax
jne 0x140003ede
lea rax, [rcx + rcx*2]
cmp word [r14 + rax*8], di
je 0x140003e9e
add esi, dword [r14 + rax*8 + 4]
cmp qword [r14 + rax*8 + 8], rdi
je 0x140003e9e
add rbx, 2
movzx ecx, word [rbx]
call fcn.140033450
test eax, eax
jne 0x140003f0d
movsxd rax, ebp
lea r10, [rax + rax*2]
mov ecx, dword [r14 + r10*8 + 0x10]
test ecx, ecx
je 0x140003f5c
sub ecx, 1
je 0x140003f4a
cmp ecx, 1
je 0x140003f3b
mov esi, edi
jmp 0x140003f72
mov rdx, qword [r14 + r10*8 + 8]
mov rcx, rbx
call fcn.140033204
jmp 0x140003f72
mov rdx, qword [r14 + r10*8 + 8]
mov r8b, 1
mov rcx, rbx
call fcn.140033124
jmp 0x140003f72
mov rcx, qword [r14 + r10*8 + 8]
or r9, 0xffffffffffffffff
mov r8, rbx
mov edx, 0x103
call fcn.1401525e0
mov eax, esi
and eax, 0x60
jne 0x140003fbf
mov eax, 8
test al, sil
jne 0x140003fbf
mov edx, 0x1eee
test edx, esi
je 0x140003fbd
mov ecx, edi
mov eax, 1
shl eax, cl
test edx, eax
je 0x140003fa5
test esi, eax
je 0x140003fa5
mov ecx, esi
sub ecx, eax
test edx, ecx
jne 0x140003fbd
inc edi
cmp edi, r15d
jb 0x140003f8c
mov ecx, esi
and ecx, 0x104
cmp ecx, 4
je 0x140003fbd
mov eax, esi
jmp 0x140003fbf
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140003fd8
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [0x140230f28]
xor r9d, r9d
and qword [rsp + 0x20], 0
xor r8d, r8d
mov qword [0x140226938], rcx
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x140226930], rax
test rax, rax
je 0x1400040f0
mov edx, dword [rax]
lea ecx, [rdx - 0x9cb8]
test ecx, 0xffffffbf
jne 0x1400040f0
mov r9d, dword [rax + 4]
mov ebx, 1
lea ecx, [r9 - 0x20000]
cmp ecx, ebx
ja 0x1400040f0
mov r8d, 0x9cb8
cmp r9d, 0x20000
jne 0x140004056
cmp edx, r8d
jne 0x1400040f0
mov ecx, 0x9cf8
cmp r9d, 0x20001
jne 0x14000406c
cmp edx, ecx
jne 0x1400040f0
cmp r9d, 0x20000
jne 0x14000407e
cmp edx, r8d
je 0x14000407e
cmp edx, ecx
jne 0x1400040f0
mov rdx, rax
lea rcx, [0x140226948]
call fcn.140130600
cmp qword [0x140226980], 0
mov dword [0x14022694c], 0x20000
je 0x1400040f0
cmp qword [0x140226968], 0
je 0x1400040f0
cmp qword [0x140226978], 0
je 0x1400040f0
cmp dword [0x14022602c], 0
jne 0x1400040c8
cmp qword [0x140226988], 0
je 0x1400040f0
mov r9d, dword [0x1402269a0]
mov r8d, dword [0x140226998]
mov edx, dword [0x140226994]
mov ecx, dword [0x140226990]
call fcn.140028484
call fcn.140022ce0
test eax, eax
jne 0x1400040f2
xor ebx, ebx
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140004e9c
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x140230ae0]
call fcn.140023750
xor ebx, ebx
cmp word [0x140230b00], bx
je 0x140004ecd
lea rcx, [0x140230b00]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov word [0x140230b00], bx
lea rcx, [0x140230ac0]
call fcn.140023750
cmp word [0x140230d08], bx
je 0x140004f2e
test byte [0x14022699c], 8
je 0x140004f1a
or r9, 0xffffffffffffffff
lea r8, [0x140230d08]
mov edx, 0x104
lea rcx, str.DataContractName
call fcn.1401525e0
lea rdx, str.DataContractName
mov ecx, 2
call fcn.14000919c
jmp 0x140004f27
lea rcx, [0x140230d08]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov word [0x140230d08], bx
add rsp, 0x20
pop rbx
ret
Function at 0x14000c20c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
xor ebp, ebp
lea rcx, [rsp + 0x70]
cmp dword [0x1401e3f60], ebp
mov eax, 0x10e0
cmovne eax, dword [reloc.OLEAUT32.dll_VariantTimeToSystemTime]
lea esi, [rbp + 0x14]
cmp eax, esi
cmova esi, eax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rsp + 0x70]
mov r9d, 0x20019
mov edx, dword [rsp + 0x74]
shl rdx, 0x20
add rdx, rax
movabs rax, 0x19db1ded53e8000
cmp rdx, rax
mov rcx, rax
cmova rcx, rdx
xor r8d, r8d
sub rcx, rax
movabs rax, 0xe5109ec205d7bea7
mul rcx
lea rax, [rsp + 0x78]
mov rcx, 0xffffffff80000001
mov rdi, rdx
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftPCHealthErrorReportingDW
shr rdi, 0x1d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000c31e
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.LastQueuePesterTime
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000c31e
sub edi, dword [rsp + 0x68]
cmp edi, esi
ja 0x14000c31e
cmp dword [0x1401e3f88], ebp
je 0x14000c31a
cmp dword [0x1401e3f90], ebp
je 0x14000c31a
cmp word [0x1402321a0], bp
je 0x14000c31a
lea rdx, [0x1402321a0]
lea rcx, str.Failed_queued_reporting_pester_check_r_n
call fcn.140025aa4
xor eax, eax
jmp 0x14000c323
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000c7b0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov edi, dword [rcx]
mov rbx, rcx
mov rcx, qword [rcx + 8]
and edi, 7
test edx, edx
mov dword [rsp + 0x40], 4
lea rdx, str.OkToReportFromTheseQueues
jne 0x14000c7e4
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x14000c875
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000c81e
cmp eax, 2
jne 0x14000c858
mov edx, dword [rbx]
mov ecx, edi
and edx, 0x10000000
call fcn.14000c614
jmp 0x14000c822
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbx + 8]
lea rdx, str.OkToReportFromTheseQueues
or eax, edi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x48], eax
mov r9d, 4
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14000c875
mov rax, qword [0x14021eec0]
lea rcx, [0x14021eec0]
mov edx, 0x30303030
mov rax, qword [rax + 8]
call qword [case.0x14000c75c.0]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000ca4c
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x1401e3028]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebp, ebp
mov rdi, rcx
cmp dword [0x1401e3f88], ebp
je 0x14000caa4
cmp dword [0x1401e3f90], ebp
je 0x14000caa4
cmp word [0x1402321a0], bp
je 0x14000caa4
lea rdx, [0x1402321a0]
lea rcx, str.Clearing_queue_r_n
call fcn.140025aa4
mov ecx, dword [rdi]
and ecx, 0xfffcffff
call fcn.14000fed0
mov ebx, 0x104
lea r8, [rdi + 0x10]
mov edx, ebx
lea rcx, [rsp + 0x20]
or r9, 0xffffffffffffffff
call fcn.1401525e0
mov r8d, ebx
lea rdx, [rsp + 0x20]
lea rcx, [0x140189654]
call fcn.14003348c
mov r8d, ebx
lea rdx, [rsp + 0x20]
lea rcx, str.dwq.snt
call fcn.14003348c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140223220]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [rdi + 0x228]
test rbx, rbx
je 0x14000cb87
mov esi, ebp
cmp dword [rbx], ebp
jbe 0x14000cb6e
mov rcx, qword [rbx + 0x10]
mov eax, esi
imul r14, rax, 0x458
add rcx, r14
je 0x14000cb3b
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rdi + 0x228]
lea rcx, [r14 + 0x208]
add rcx, qword [rbx + 0x10]
je 0x14000cb55
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rdi + 0x228]
mov rcx, qword [rbx + 0x10]
add rcx, r14
call fcn.14000c880
mov rbx, qword [rdi + 0x228]
inc esi
cmp esi, dword [rbx]
jb 0x14000cb1c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14000cb84
mov rdx, qword [rbx + 0x18]
call fcn.1400321f8
mov qword [rbx + 0x10], rbp
mov qword [rbx], rbp
lea rcx, [0x140223220]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14012e400
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000f1e8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x40
mov r9, rdx
mov dword [rsp + 0x28], 0x80
mov edx, 0x100002
mov dword [rsp + 0x20], 2
xor r8d, r8d
call fcn.140106fdc
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000f240
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x1401e3f88], 0
mov dword [rsp + 0x60], eax
je 0x14000f290
cmp dword [0x1401e3f90], 0
je 0x14000f290
lea rcx, str.Failed_to_create_snt._GLE:__u_r_n
jmp 0x14000f289
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14000f294
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x1401e3f88], ebx
mov dword [rsp + 0x60], eax
je 0x14000f290
cmp dword [0x1401e3f90], ebx
je 0x14000f290
lea rcx, str.Failed_to_write_snt._GLE:__u_r_n
mov edx, eax
call fcn.140025c48
xor eax, eax
jmp 0x14000f299
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rsi
ret
Function at 0x140010634
Capabilities:
Check if file exists
Check internet connectivity via wininet
Get file attributes

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp dword [0x1401e3dd0], ebx
je 0x1400106bd
mov rcx, qword [0x1401e3dd8]
test rcx, rcx
je 0x1400106bd
cmp word [rcx], bx
je 0x1400106bd
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140010668
and eax, 0x10
jne 0x1400106d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1401e3f88]
mov dword [rsp + 0x30], eax
test ecx, ecx
je 0x1400106ce
cmp dword [0x1401e3f90], ebx
je 0x1400106a1
mov rdx, qword [0x1401e3dd8]
lea rcx, str.FReportToQueue:_File_Tree_Root_does_not_exist:__S_r_n
call fcn.140025c48
mov eax, dword [rsp + 0x30]
mov ecx, dword [0x1401e3f88]
test ecx, ecx
je 0x1400106ce
cmp dword [0x1401e3f90], ebx
je 0x1400106ce
mov edx, eax
lea rcx, str.FReportToQueue:_GetLastError_u_r_n
call fcn.140025c48
jmp 0x1400106ce
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x1400106d2
xor eax, eax
jmp 0x1400106d7
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400106e0
Capabilities:
Check internet connectivity via wininet

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x1401e3dd8]
xor ebp, ebp
mov rbx, rcx
mov ecx, dword [0x1401e3dd0]
mov rdi, r9
mov rsi, rdx
test r8d, r8d
jne 0x140010723
test ecx, ecx
je 0x140010723
test rax, rax
je 0x140010723
cmp word [rax], bp
jne 0x1400107e3
cmp dword [0x1401e3ec0], ebp
je 0x140010737
cmp dword [0x1401e3ec8], ebp
jne 0x1400107e3
cmp dword [0x1401e3d80], ebp
je 0x14001074b
cmp dword [0x1401e3d88], ebp
je 0x1400107e3
test ecx, ecx
je 0x140010759
test rax, rax
je 0x140010759
cmp word [rax], bp
jne 0x140010775
xor edx, edx
mov dword [rsp + 0x40], ebp
lea rcx, [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x140010775
test byte [rsp + 0x40], 0x10
je 0x1400107e3
test byte [rbx], 0x80
jne 0x1400107e3
cmp dword [0x1401e3cb0], ebp
je 0x14001078a
cmp dword [0x1401e3cb8], ebp
jne 0x1400107e3
mov rdx, rsi
mov rcx, rbx
call fcn.1400107fc
mov esi, 1
test eax, eax
je 0x1400107d6
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x58]
bts ecx, 0x1c
mov dword [rdi + 0x1170], ecx
mov dword [rax + 0x10], ecx
mov eax, dword [rbx]
and al, 6
cmp al, 4
jne 0x1400107df
call fcn.14002271c
call fcn.140022850
mov ecx, esi
call fcn.1400225e8
mov ecx, esi
call fcn.140022790
jmp 0x1400107df
call fcn.140010634
test eax, eax
je 0x1400107e3
mov eax, esi
jmp 0x1400107e5
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140012af0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
xor r12d, r12d
mov rcx, qword [rcx]
test rcx, rcx
je 0x140012c39
or r13, 0xffffffffffffffff
mov rax, r13
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140012b25
movsxd rbx, eax
lea r15d, [rax + 1]
lea rcx, [rbx + 1]
shl rcx, 3
call fcn.14015319c
mov rbp, rax
test rax, rax
je 0x140012c39
test r15d, r15d
jle 0x140012b66
mov r8, qword [rsi]
lea rdx, [rbx + 1]
mov r9, r13
mov rcx, rax
call fcn.1401525e0
mov rbx, qword [rsi]
mov r14, rbp
mov rdi, rbp
mov edx, 0x7c
movzx eax, word [rdi]
test ax, ax
je 0x140012ba5
movzx ecx, ax
movzx eax, cx
cmp cx, dx
je 0x140012b96
add rdi, 2
movzx eax, word [rdi]
movzx ecx, ax
test ax, ax
jne 0x140012b7f
test ax, ax
je 0x140012ba5
mov word [rdi], r12w
add rdi, 2
jmp 0x140012ba8
mov rdi, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140012bc1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140012c18
mov rcx, qword [rsi]
cmp rbx, rcx
je 0x140012bd8
mov eax, 0x7c
mov word [rbx], ax
add rbx, 2
mov rcx, qword [rsi]
mov rax, rbx
sub rax, rcx
mov ecx, r15d
sar rax, 1
sub ecx, eax
test ecx, ecx
jle 0x140012bfb
movsxd rdx, ecx
mov r9, r13
mov rcx, rbx
mov r8, r14
call fcn.1401525e0
test rbx, rbx
je 0x140012c0f
mov rax, r13
inc rax
cmp word [rbx + rax*2], r12w
jne 0x140012c03
jmp 0x140012c12
mov rax, r12
cdqe
lea rbx, [rbx + rax*2]
mov r14, rdi
mov edx, 0x7c
test rdi, rdi
jne 0x140012b74
cmp rbx, qword [rsi]
jne 0x140012c31
mov qword [rsi], r12
mov rcx, rbp
call fcn.140152ed8
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret