joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18016520f
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsx eax, r15w
mov qword [rsp + 0x18], rbp
push rsi
movsxd rax, ebx
push rdi
cbw
cwde
push r14
cmovs ax, r11w
mov eax, 0x1450
jmp 0x18016523c
call fcn.180168895
sub rsp, rax
mov rax, qword [0x180094010]
xor rax, rsp
sub r14d, edx
bswap r14d
mov qword [rsp + 0x1440], rax
cwde
bsr r10, r12
movsxd r10, edx
movsx edi, ax
rcr sil, 0x5d
shld rax, r14, 0xb8
mov rdi, rcx
setbe cl
mov rax, r10
rol dh, 0x79
xor cl, ch
mov ebp, r9d
rcr ch, 0x31
sbb rsi, 0x494f4a55
xchg r14d, esi
sar rax, 6
neg sil
xadd si, dx
lea rcx, [0x180096a40]
ror r14b, cl
adc dl, 0x21
and r10d, 0x3f
mov r14b, 0x1d
sub si, 0x7c99
movsx r14, r8w
add rbp, r8
rcr sil, 0xf9
movsx edx, r15w
mov rsi, r8
mov rax, qword [rcx + rax*8]
add dx, 0x2443
lea rdx, [r10 + r10*8]
shl r14b, 0xb3
bsr r14, rcx
ror r14, 0xb4
mov r14, qword [rax + rdx*8 + 0x28]
stc
test r14b, al
cmp rbp, 0x6f3d05f4
sub eax, eax
jmp 0x1801652fa
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8w, ax
cmp r8, rbp
jmp 0x18016530c
jae 0x180165426
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x18016531f
jae 0x180165389
movzx eax, word [rsi]
add rsi, 2
jmp 0x180165339
cmp ax, 0xa
jmp 0x180165342
jne 0x18016535f
add dword [rdi + 8], 2
mov ecx, 0xd
jmp 0x180165357
mov word [rbx], cx
add rbx, 2
cmc
mov word [rbx], ax
or ax, 0x5967
rol al, cl
add rbx, 2
rcl ax, 0x76
lea rax, [rsp + 0x143e]
test edi, r13d
cmp rbx, rax
jmp 0x180165383
jb 0x180165317
and qword [rsp + 0x20], 0
jmp 0x180165396
lea rax, [rsp + 0x40]
bsf rcx, r12
mov cl, 1
sub rbx, rax
shl cx, cl
xadd r8w, r9w
sal r8b, cl
lea r9, [rsp + 0x30]
ror rcx, 0x36
sar rbx, 1
xchg dh, ch
cmc
lea rdx, [rsp + 0x40]
rcr cx, cl
add ebx, ebx
mov r8b, 0x41
mov rcx, r14
mov r8w, 0x11e2
movzx r8w, r13b
mov r8d, ebx
jmp 0x1801653e0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1801653ed
je 0x18016541b
mov eax, dword [rsp + 0x30]
clc
cmp dh, 0x6e
cmc
add dword [rdi + 4], eax
stc
cmp eax, ebx
jmp 0x180165407
jb 0x180165426
cmp rsi, rbp
jb 0x180165312
jmp 0x180165426
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
inc rcx
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x180165439
call fcn.18014c161
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
movsx rbp, cx
mov rbp, qword [r11 + 0x30]
mov rsp, r11
not rsi
pop r14
pop rdi
seto sil
movsx esi, r13w
movzx rsi, r12w
pop rsi
ret
Function at 0x140001f20
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov r11, rsp
push rsi
push rdi
sub rsp, 0x268
mov rax, qword [0x14003b7a0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [r11 + 8], rbx
mov rsi, rdx
mov qword [r11 - 0x18], r14
mov rbx, rcx
xor r14b, r14b
call fcn.140004090
xor edi, edi
test al, al
je 0x140001fc0
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call fcn.1400025d0
test al, al
je 0x140001fc0
mov r8, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x290], rbp
lea edx, [rdi + 0x1a]
mov ebp, 1
mov qword [rsp + 0x20], rax
mov r9d, ebp
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, r14b
cmove ebx, ebp
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x290]
test bl, bl
jne 0x140001fd4
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r14, qword [rsp + 0x260]
lea rcx, [rsp + 0x40]
mov rbx, qword [rsp + 0x280]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x140001ff0
test eax, eax
je 0x1400020b0
lea rcx, [rsp + 0x40]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x140002010
mov eax, dword [0x1400267bc]
lea rdx, [rsp + 0x40]
sub rdx, 2
mov dword [rcx], eax
nop dword [rax + rax]
cmp word [rdx + 2], di
lea rdx, [rdx + 2]
jne 0x140002030
mov ecx, dword [0x140026780]
movups xmm0, xmmword [str.WanNengZip]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], ecx
movzx ecx, word [0x140026784]
mov word [rdx + 0x14], cx
lea rcx, [rsp + 0x40]
sub rcx, 2
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x140002061
mov dword [rcx], eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140002086
lea rcx, [rsp + 0x40]
call fcn.1400062b0
cmp word [rsp + 0x40], di
je 0x1400020a0
lea rax, [rsp + 0x40]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140002096
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140005c10
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14000e8a0
add rsp, 0x268
pop rdi
pop rsi
ret
Function at 0x1400020d0
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov r11, rsp
push rsi
push rdi
sub rsp, 0x268
mov rax, qword [0x14003b7a0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [r11 + 8], rbx
mov rsi, rdx
mov qword [r11 - 0x18], r14
mov rbx, rcx
xor r14b, r14b
call fcn.140004090
xor edi, edi
test al, al
je 0x140002170
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call fcn.1400025d0
test al, al
je 0x140002170
mov r8, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x290], rbp
lea edx, [rdi + 0x1a]
mov ebp, 1
mov qword [rsp + 0x20], rax
mov r9d, ebp
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, r14b
cmove ebx, ebp
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x290]
test bl, bl
jne 0x140002184
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r14, qword [rsp + 0x260]
lea rcx, [rsp + 0x40]
mov rbx, qword [rsp + 0x280]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x1400021a0
test eax, eax
je 0x14000226a
lea rcx, [rsp + 0x40]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x1400021c0
mov eax, dword [0x1400267bc]
lea rdx, [rsp + 0x40]
sub rdx, 2
mov dword [rcx], eax
nop dword [rax + rax]
cmp word [rdx + 2], di
lea rdx, [rdx + 2]
jne 0x1400021e0
movzx ecx, word [0x1400267b8]
movups xmm0, xmmword [str.WanNengZip.users]
movups xmm1, xmmword [0x1400267a8]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov word [rdx + 0x20], cx
lea rcx, [rsp + 0x40]
sub rcx, 2
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x140002213
mov dword [rcx], eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140002238
lea rcx, [rsp + 0x40]
call fcn.1400062b0
cmp word [rsp + 0x40], di
je 0x14000225a
lea rax, [rsp + 0x40]
or rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140002250
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140005c10
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14000e8a0
add rsp, 0x268
pop rdi
pop rsi
ret
Function at 0x140002440
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x888
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x14003b7a0]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x8e0]
xor edi, edi
mov dword [rsp + 0x30], edi
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.140011c00
lea rax, [rbp + 0xd0]
cmp qword [rax + 0x18], 8
jb 0x1400024ad
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x70]
mov r8, rsi
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], 8
jb 0x1400024e6
mov rax, qword [rbx]
jmp 0x1400024e9
mov rax, rbx
mov word [rax], di
cmp word [rsp + 0x70], di
je 0x14000250a
lea rax, [rsp + 0x70]
or rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140002500
mov r8, rdi
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140005c10
mov dword [rsp + 0x30], 1
cmp qword [rbx + 0x18], 8
jb 0x14000252e
mov rax, qword [rbx]
jmp 0x140002531
mov rax, rbx
mov r11, rsi
sub r11, rax
nop word [rax + rax]
movzx r10d, word [rax]
movzx edx, word [rax + r11]
sub r10d, edx
jne 0x140002556
add rax, 2
test edx, edx
jne 0x140002540
test r10d, r10d
jne 0x1400025a8
mov qword [rsp + 0x20], rsi
mov r9, r15
mov r8, r14
lea rdx, [rsp + 0x48]
mov rcx, rbp
cmp byte [rbp + 1], r10b
je 0x14000257b
call fcn.140002300
jmp 0x140002580
call fcn.140002400
mov rdx, rax
mov rcx, rbx
call fcn.140001d80
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x1400025a8
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140005d60
mov rax, rbx
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.14000e8a0
add rsp, 0x888
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400027b0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14003b7a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [rcx + 0x48], 8
lea r8, [rcx + 0x30]
mov rbx, rcx
jb 0x1400027dc
mov r8, qword [r8]
lea r9, str.Config
lea rdx, str._s_s_
lea rcx, [rsp + 0x20]
call fcn.1400060d0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14000280d
lea rcx, [rsp + 0x20]
call fcn.1400062b0
lea rax, [rsp + 0x20]
sub rax, 2
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140002820
movups xmm0, xmmword [str.Related.ini]
movsd xmm1, qword [0x1400269e0]
movups xmmword [rax], xmm0
movsd qword [rax + 0x10], xmm1
cmp word [rsp + 0x20], 0
jne 0x14000284f
xor r8d, r8d
jmp 0x14000286b
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140002860
lea rcx, [rbx + 0xb0]
lea rdx, [rsp + 0x20]
call fcn.140005c10
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000e8a0
add rsp, 0x240
pop rbx
ret
Function at 0x140003010
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14003b7a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.140011c00
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [rsp + 0x20], 0
jne 0x140003061
xor r8d, r8d
jmp 0x14000307b
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140003070
add rbx, 0x150
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140005c10
mov r8d, 1
lea rdx, [0x1400267bc]
mov rcx, rbx
call fcn.140005960
cmp qword [rbx + 0x18], 8
jb 0x1400030b0
mov rcx, qword [rbx]
jmp 0x1400030b3
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400030d0
lea r8d, [rax + 0x11]
mov rcx, rbx
lea rdx, str.C:Program_Files_
call fcn.140005c10
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000e8a0
add rsp, 0x240
pop rbx
ret
Function at 0x140004090
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x248
mov rax, qword [0x14003b7a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
movzx eax, byte [0x14003c5f8]
test al, al
jne 0x140004142
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.140011c00
mov r9d, 1
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14000413b
lea rcx, [rsp + 0x20]
call fcn.14001540c
lea rdx, str.config_systemprofile
lea rcx, [rsp + 0x20]
call fcn.140011188
test rax, rax
jne 0x14000411b
lea rdx, str.cocuments_and_settingslocalService
lea rcx, [rsp + 0x20]
call fcn.140011188
test rax, rax
je 0x14000413b
mov al, 1
mov byte [0x14003c5f8], al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000e8a0
add rsp, 0x248
ret
movzx eax, byte [0x14003c5f8]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000e8a0
add rsp, 0x248
ret
Function at 0x140005070
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov esi, r9d
mov rbp, r8
mov r14, rdx
mov rdi, rcx
xor bl, bl
call fcn.140004090
mov r15d, 1
test al, al
je 0x1400050f9
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov rcx, rdi
call fcn.1400025d0
test al, al
je 0x1400050f9
mov r8, qword [rsp + 0x30]
mov r9d, r15d
mov edx, esi
mov qword [rsp + 0x20], rbp
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmove ebx, r15d
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x1400050f9
movzx eax, bl
jmp 0x14000511c
mov r9d, dword [rsp + 0x80]
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
movzx ecx, bl
cmovne ecx, r15d
movzx eax, cl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400062b0
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
or r8, 0xffffffffffffffff
mov rbx, rcx
mov rdi, r8
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x1400062d0
lea eax, [rdi + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.14000e994
mov rsi, rax
sub rax, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x140006300
xor r14d, r14d
movsxd rdi, edi
mov ebx, r14d
lea ebp, [r14 + 1]
test rdi, rdi
js 0x14000636f
mov qword [rsp + 0x40], r15
mov r15d, 0x5c
nop dword [rax]
cmp word [rsi + rbx*2], r15w
jne 0x14000635d
mov rcx, rsi
mov word [rsi + rbx*2], r14w
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140006358
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140006367
mov word [rsi + rbx*2], r15w
inc rbx
cmp rbx, rdi
jle 0x140006330
jmp 0x14000636a
mov ebp, r14d
mov r15, qword [rsp + 0x40]
mov rcx, rsi
call fcn.14000e99c
mov rbx, qword [rsp + 0x48]
mov eax, ebp
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140006390
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x180], rbx
mov rax, qword [0x14003b7a0]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r15d, r9d
movzx r12d, r8b
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x70]
call fcn.140011c00
mov dword [rsp + 0x70], 0x68
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rbp - 8], 7
xor r13d, r13d
mov qword [rbp - 0x10], r13
mov word [rbp - 0x20], r13w
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], r13
mov word [rbp], r13w
lea r14d, [rax + 1]
or rbx, 0xffffffffffffffff
test rsi, rsi
je 0x1400064c2
cmp word [rsi], r13w
jne 0x14000643e
mov r8d, r13d
jmp 0x14000644c
mov r8, rbx
inc r8
cmp word [rsi + r8*2], 0
jne 0x140006441
mov rdx, rsi
lea rcx, [rbp]
call fcn.140005c10
cmp qword [rbp + 0x10], 0
je 0x1400064c2
mov r8, r14
lea rdx, [0x140026f00]
lea rcx, [rbp - 0x20]
call fcn.140005c10
cmp word [rdi], 0
jne 0x14000647d
mov r8, r13
jmp 0x14000648b
mov r8, rbx
inc r8
cmp word [rdi + r8*2], 0
jne 0x140006480
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.140005960
mov r8d, 2
lea rdx, [0x140026f04]
lea rcx, [rbp - 0x20]
call fcn.140005960
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp]
lea rcx, [rbp - 0x20]
call fcn.140005830
jmp 0x1400064e9
cmp word [rdi], 0
jne 0x1400064d0
mov rbx, r13
jmp 0x1400064da
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1400064d0
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.140005c10
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140006536
mov r14d, r13d
jmp 0x140006567
test r12b, r12b
je 0x140006550
or edx, 0xffffffff
test r15d, r15d
cmovg edx, r15d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rbp + 0x18]
cmp r8, 8
jb 0x140006581
inc r8
mov rdx, qword [rbp]
lea rcx, [rbp]
call fcn.140005d60
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], r13
mov word [rbp], r13w
mov r8, qword [rbp - 8]
cmp r8, 8
jb 0x1400065ac
inc r8
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.140005d60
mov eax, r14d
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14000e8a0
mov rbx, qword [rsp + 0x180]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006f50
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14003b7a0]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
test rcx, rcx
jne 0x140006f93
xor eax, eax
jmp 0x140007122
mov qword [rsp + 0x60], 7
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp word [rcx], bx
jne 0x140006fb2
mov r8d, ebx
jmp 0x140006fc0
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], bx
jne 0x140006fb6
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140005c10
nop
lea rcx, [rsp + 0x48]
call fcn.1400082c0
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x70]
call fcn.140011c00
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140007103
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400070f9
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
cmp word [rbp - 0x64], 0
jne 0x14000703d
mov r8, rbx
jmp 0x140007050
lea rax, [rbp - 0x64]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140007045
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x28]
call fcn.140005c10
nop
lea rcx, [rsp + 0x28]
call fcn.1400082c0
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x28]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x40]
cmp rdi, 8
cmovae rcx, r14
mov r9, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
call fcn.140005720
test eax, eax
je 0x1400070cd
cmp rdi, 8
jb 0x1400070bb
lea r8, [rdi + 1]
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.140005d60
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x140007016
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x78]
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x140007103
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140005d60
jmp 0x140007103
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x140007120
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140005d60
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14000e8a0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140007d70
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14003b7a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.140011c00
lea rcx, [rsp + 0x20]
mov r8, rdi
test ebx, ebx
jne 0x140007dcc
lea rdx, [0x140026f10]
call fcn.140008830
jmp 0x140007ddb
mov r9d, ebx
lea rdx, str._s.bak_d
call fcn.140008830
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140007df5
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400155d8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 5]
test eax, eax
jne 0x140007e3d
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp ebx, 0xa
jge 0x140007e52
inc ebx
jmp 0x140007da0
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000e8a0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140007e80
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x70
xor ebp, ebp
lea rax, [r11 - 0x28]
mov rsi, r9
mov qword [r11 - 0x28], rbp
mov rdi, r8
mov qword [r11 - 0x20], rbp
mov rbx, rcx
mov qword [r11 - 0x18], rbp
mov r9d, 0xf013f
mov qword [r11 - 0x10], rbp
xor r8d, r8d
mov qword [r11 - 0x58], rax
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007fe0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov r9d, 0xf013f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftWare
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007fd5
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rdx, rbx
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140007fca
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rdx, rdi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140007fbf
mov rcx, qword [rsp + 0xa0]
or rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x140007f82
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret