joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800018a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov ebx, edx
lea r9, [rsp + 0x20]
mov edx, edx
mov r8d, 0x40
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov edx, 0x90
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18000d2f0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180001910
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov ebx, r8d
lea r9, [rsp + 0x20]
mov rdi, rdx
mov r8d, 0x40
mov edx, ebx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18000d2f0
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x180001980
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
jmp qword [sym.imp.KERNEL32.dll_VirtualAlloc]

Function at 0x1800019a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x26], rdx
lea r9, [rsp + 0x30]
mov edx, 0xe
mov dword [rsp + 0x20], 0x25ff
mov rbx, rcx
mov word [rsp + 0x24], 0
lea r8d, [rdx + 0x32]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsp + 0x28]
lea r9, [rsp + 0x30]
movsd xmm0, qword [rsp + 0x20]
mov edx, 0xe
mov r8d, dword [rsp + 0x30]
mov rcx, rbx
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [rsp + 0x2c]
mov word [rbx + 0xc], ax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18000d2f0
add rsp, 0x40
pop rbx
ret

Function at 0x180001a30
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [r9 + r8 - 8], rdx
mov rdi, r8
mov ebx, r9d
mov r8d, 0x40
mov edx, ebx
lea r9, [rsp + 0x20]
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18000d2f0
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x180001aa0
Capabilities:
Encode data using xor
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov qword [rbp - 0x18], rbx
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov edx, 0x402e
lea r10d, [rbx + 0xf]
mov ecx, 0x403b
mov eax, 0x4018
mov word [rbp - 0x50], ax
movabs r9, 0xf0a1f10656b44054
mov eax, 0x4035
mov word [rbp - 0x4e], ax
lea r11d, [rdx + 0x26]
mov eax, 0x403a
mov word [rbp - 0x4c], ax
mov eax, 0x403f
mov word [rbp - 0x4a], ax
mov eax, 0x4038
mov word [rbp - 0x48], ax
mov eax, 0x402a
mov word [rbp - 0x46], cx
mov word [rbp - 0x44], ax
mov eax, 0x4028
mov word [rbp - 0x42], cx
mov ecx, 0x4014
mov word [rbp - 0x40], ax
mov eax, 0x407f
mov word [rbp - 0x3e], dx
mov word [rbp - 0x3c], ax
mov eax, 0x4062
mov word [rbp - 0x3a], ax
mov eax, 0x4041
mov word [rbp - 0x38], ax
mov eax, 0x402f
mov word [rbp - 0x36], ax
mov eax, 0x4020
mov word [rbp - 0x34], dx
mov word [rbp - 0x32], ax
mov eax, 0x4040
mov word [rbp - 0x30], ax
mov eax, 0x4030
mov word [rbp - 0x2e], ax
mov eax, 0x400c
mov word [rbp - 0x2c], cx
mov word [rbp - 0x2a], ax
mov eax, 0x401b
mov word [rbp - 0x28], cx
mov word [rbp - 0x26], ax
mov eax, 0x404c
mov word [rbp - 0x24], ax
mov eax, 0x403e
mov word [rbp - 0x22], ax
mov eax, 0x4005
mov word [rbp - 0x20], ax
mov eax, 0x406f
mov word [rbp - 0x1e], dx
mov word [rbp - 0x1c], ax
movzx eax, word [rbp - 0x50]
nop dword [rax]
movzx r8d, word [rbp + rbx*2 - 0x50]
lea eax, [r11 + rbx]
mov rcx, rbx
mov rdx, r9
and ecx, r10d
cmp rcx, r10
cmovae rcx, r10
shl cl, 2
shr rdx, cl
and dx, r10w
xor dx, ax
xor dx, r8w
mov word [rbp + rbx*2 - 0x50], dx
inc rbx
cmp rbx, 0x1b
jb 0x180001bc0
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x18000f5f0]
lea rdx, str.CONOUT_
lea rcx, [rbp - 0x18]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000d2f0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18000c3e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test edx, edx
je 0x18000c3fc
sub edx, 1
je 0x18000c40e
sub edx, 1
je 0x18000c3fc
cmp edx, 1
jne 0x18000c44f
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
mov qword [0x1800126f8], rbx
mov qword [rsp + 0x28], rax
lea r8, [0x180002520]
mov r9, rbx
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180012700], rax
test rax, rax
je 0x18000c44f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140001d80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor ebp, ebp
mov rsi, r8
mov rdi, rdx
mov ebx, 0x8000ffff
test rdx, rdx
je 0x140001db6
mov word [rdx], bp
lea rdx, [rsp + 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x140001e72
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoCreateGuid]
mov ebx, eax
test eax, eax
js 0x140001e72
mov r8d, 0x27
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_StringFromGUID2]
lea r8, str.IEEtwSession.Temporal.
lea rcx, [rsp + 0x80]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x140001e72
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x140001e72
lea r8, str..etl
lea rcx, [rsp + 0x80]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x140001e72
mov rdx, qword [rsi]
lea r8, [rsp + 0x80]
mov rcx, rdi
call fcn.140001f74
mov ebx, eax
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], bp
jne 0x140001e66
mov qword [rsi], rax
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140008070
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x2a0
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000348c
Capabilities:
Delete service
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140003516
mov rdx, qword [rbx + 0x28]
mov r8d, 0x10004
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x14000350d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140003504
cmp dword [rsp + 0x24], 1
jne 0x140003504
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x140003504
call fcn.140003a2c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140008070
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140003534
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1400035bf
mov rdx, qword [rbx + 0x28]
mov r8d, 0x24
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x1400035b6
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400035ad
cmp dword [rsp + 0x24], 1
je 0x1400035ad
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140008070
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140003a2c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
lea rcx, str.IEEtwProxyStub.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x140003a94
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
lea rdx, str.Failed_to_load_IEEtwProxyStub.dll_with_HResult
or r8d, 0x80070000
lea rcx, str.ERROR:__s:_0x_08x_n
test eax, eax
cmovle r8d, eax
call fcn.140008564
jmp 0x140003b09
lea rdx, str.DllUnregisterServer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x140003acc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
lea rdx, str.Failed_to_load_IEEtwProxyStub.dll_with_HResult
or r8d, 0x80070000
test eax, eax
cmovle r8d, eax
jmp 0x140003af4
mov rcx, rax
call qword [fcn.140001900]
call rdi
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x140003b00
cmp eax, 0x80070490
je 0x140003b00
mov r8d, eax
lea rdx, str.Failed_to_Unregister_IEEtwProxyStub.dll_with_HResult
lea rcx, str.ERROR:__s:_0x_08x_n
call fcn.140008564
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r8d, 0x27
lea rdx, [rsp + 0x20]
lea rcx, [0x140016178]
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_StringFromGUID2]
test eax, eax
jne 0x140003b3d
lea rdx, str.Failed_during_a_call_to_StringFromGUID
lea rcx, str.ERROR:__s
call fcn.140008564
jmp 0x140003c3b
mov edi, 0x104
lea r8, str.CLSID_
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.140001f74
mov ebx, eax
test eax, eax
js 0x140003c25
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x140003c25
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, 0xfffffffd
je 0x140003bb3
movzx ebx, ax
lea rdx, [rsp + 0x70]
or ebx, 0x80070000
lea rcx, str.ERROR:_Failed_to_delete_registry_key__s__error:_0x_08x_n
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.140008564
test ebx, ebx
js 0x140003c25
lea r8, str.AppID_
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140001f74
mov ebx, eax
test eax, eax
js 0x140003c25
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x140003c25
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, 0xfffffffd
je 0x140003c21
movzx ebx, ax
lea rdx, [rsp + 0x70]
or ebx, 0x80070000
lea rcx, str.ERROR:_Failed_to_delete_registry_key__s__error:_0x_08x_n
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.140008564
test ebx, ebx
jns 0x140003c3b
mov r8d, ebx
lea rdx, str.Failed_while_cleaning_up_registry_with_HResult
lea rcx, str.ERROR:__s:_0x_08x_n
call fcn.140008564
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140008070
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret
Function at 0x140003c64
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rbp + 0x47], rax
and qword [rbp - 9], 0
xor eax, eax
and dword [rbp + 0x37], 0
mov rbx, rdx
and qword [rbp + 0x3f], 0
lea rdx, str.Internet_Explorer_ETW_Collector_Service
mov qword [rbp + 0x27], rdx
lea rdx, str.ETW_Collector_Service_for_Internet_Explorer._When_running__this_service_collects_real_time_ETW_events_and_processes_them.
mov qword [rbp + 0x2f], rdx
lea rdx, [rbp - 9]
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov dword [rbp + 0x17], eax
lea rax, str.IEEtwCollectorService
mov qword [0x14001d3b0], rdx
mov qword [rbp + 0x1f], rax
cmp ecx, 1
jle 0x140003dc8
mov rcx, qword [rbx + 8]
lea rdx, str.install
call fcn.1400083c4
test eax, eax
jne 0x140003d02
lea rcx, [rbp - 9]
call fcn.14000324c
jmp 0x140003deb
mov rcx, qword [rbx + 8]
lea rdx, str.uninstall
call fcn.1400083c4
test eax, eax
jne 0x140003d24
lea rcx, [rbp - 9]
call fcn.14000348c
jmp 0x140003deb
mov rcx, qword [rbx + 8]
lea rdx, str.stop
call fcn.1400083c4
test eax, eax
jne 0x140003d46
lea rcx, [rbp - 9]
call fcn.140003534
jmp 0x140003deb
mov rcx, qword [rbx + 8]
lea rdx, str.start
call fcn.1400083c4
test eax, eax
jne 0x140003dc4
xor edx, edx
lea r8d, [rax + 1]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140003deb
mov rdx, qword [rbp + 0x1f]
mov r8d, 0x14
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140003db9
lea rdx, [rbp - 0x29]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140003db0
cmp dword [rbp - 0x25], 1
jne 0x140003db0
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140003deb
mov rax, qword [rbp + 0x1f]
and qword [rbp - 0x19], 0
lea rcx, [rbp - 0x29]
and qword [rbp - 0x11], 0
mov qword [rbp - 0x29], rax
lea rax, [0x140002ff0]
mov qword [rbp - 0x21], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140008070
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140005740
Capabilities:
Check if file exists
Create directory
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, qword [rbp + 0x1f0]
mov rdi, r9
xor r15d, r15d
mov r14, r8
mov r9, rdx
mov ebx, 0x80070057
test rdi, rdi
je 0x14000578d
mov word [rdi], r15w
test rdx, rdx
je 0x140005882
mov edx, 0x7ffffffe
mov rcx, r9
mov eax, edx
cmp word [rcx], r15w
je 0x1400057b0
add rcx, 2
sub rax, 1
jne 0x1400057a0
test rax, rax
je 0x140005882
mov ebx, r15d
sub rdx, rax
je 0x140005882
mov r8d, 0x104
lea rdx, [rbp - 0x80]
mov rcx, r9
mov ebx, 0x8000ffff
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x140005882
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000586e
test al, 0x10
je 0x14000586e
mov r8d, 0x27
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_StringFromGUID2]
lea r8, [0x140016f38]
lea rcx, [rbp - 0x80]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x140005882
lea r8, [rsp + 0x32]
mov word [rsp + 0x7a], r15w
lea rcx, [rbp - 0x80]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x140005882
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000586e
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000586e
mov rdx, qword [rsi]
lea r8, [rbp - 0x80]
mov rcx, rdi
call fcn.140001f74
mov ebx, eax
jmp 0x140005882
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140008070
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006fdc
Capabilities:
Create thread
Delete file

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r15d, r8d
mov r12d, edx
mov rdi, qword [rcx]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400071ab
mov r13d, edx
and r13d, 1
and r12d, 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov r8, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
test r8, r8
je 0x140007059
jmp 0x140007045
lea ecx, [rax + 1]
lock cmpxchg dword [r8 + 8], ecx
je 0x14000704f
mov eax, dword [r8 + 8]
test eax, eax
jne 0x14000703a
jmp 0x140007059
lea rcx, [rbp - 0x18]
call fcn.14000185c
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov r8, qword [rbx + 0x28]
mov rdx, qword [rbx + 0x20]
test r8, r8
je 0x14000708f
jmp 0x14000707b
lea ecx, [rax + 1]
lock cmpxchg dword [r8 + 8], ecx
je 0x140007085
mov eax, dword [r8 + 8]
test eax, eax
jne 0x140007070
jmp 0x14000708f
lea rcx, [rbp - 0x28]
call fcn.14000185c
nop
mov r14, qword [rbp - 0x18]
test r13d, r13d
je 0x1400070b5
test r15d, r15d
jne 0x1400070a7
mov rcx, r14
call fcn.140007884
jmp 0x1400070b5
cmp r15d, 1
jne 0x1400070b5
mov rcx, r14
call fcn.140007a3c
test r12d, r12d
je 0x140007140
test r15d, r15d
jne 0x1400070f0
mov rsi, qword [rbp - 0x28]
mov qword [rsi + 0x18], r14
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], r15d
mov r9, rsi
lea r8, [0x140001930]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x30], rax
jmp 0x140007140
cmp r15d, 1
jne 0x14000712b
mov rsi, qword [rbp - 0x28]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x140007140
call fcn.140007a3c
or edx, 0xffffffff
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsi + 0x30], 0
and qword [rsi + 0x18], 0
jmp 0x140007140
cmp r15d, 2
jne 0x140007140
mov rax, qword [rbp - 0x28]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140007196
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140007196
mov r14, qword [rbp - 0x20]
mov rax, qword [r14]
mov rsi, qword [rax]
mov rcx, rsi
call qword [fcn.140001900]
mov rcx, r14
call rsi
or eax, 0xffffffff
lock xadd dword [r14 + 0xc], eax
cmp eax, 1
jne 0x140007196
mov r14, qword [rbp - 0x20]
mov rax, qword [r14]
mov rsi, qword [rax + 8]
mov rcx, rsi
call qword [fcn.140001900]
mov rcx, r14
call rsi
nop
lea rcx, [rbp - 0x18]
call fcn.1400015fc
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140007023
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400071d0
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
lea edx, [rdi + 2]
mov r8d, edx
call fcn.140006fdc
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x140007211
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140007211
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007e20
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140007e60
mov eax, 0xff
jmp 0x14000800f
mov r8d, dword [rsp + 0x3c]
and r8d, 0x7fff
mov r9d, dword [rsp + 0x40]
cmp r9d, 2
je 0x140007e7c
bts r8d, 0xf
mov edx, dword [rsp + 0x34]
mov ecx, edx
shl ecx, 8
mov eax, dword [rsp + 0x38]
add ecx, eax
mov dword [0x14001ca88], r9d
mov dword [0x14001ca90], ecx
mov dword [0x14001ca94], edx
mov dword [0x14001ca98], eax
mov dword [0x14001ca8c], r8d
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140007ef3
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140007ef3
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x140007ef3
xor ebx, ebx
cmp dword [rax + 0x84], 0xe
jbe 0x140007ef5
cmp dword [rax + 0xf8], ebx
setne bl
jmp 0x140007ef5
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov edi, 1
mov ecx, edi
call fcn.14000a134
test eax, eax
jne 0x140007f2b
cmp dword [0x14001c4e8], 2
je 0x140007f17
call fcn.140009f18
mov ecx, 0x1c
call fcn.140009f64
mov ecx, 0xff
call fcn.140009b00
call fcn.1400099c0
test eax, eax
jne 0x140007f57
cmp dword [0x14001c4e8], 2
je 0x140007f42
call fcn.140009f18
mov ecx, 0x10
call fcn.140009f64
mov ecx, 0xff
call fcn.140009b00
nop
call fcn.14000a1a8
test eax, eax
jns 0x140007f6a
mov ecx, 0x1b
call fcn.140009b1c
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x14001e690], rax
call fcn.14000a93c
mov qword [0x14001c4e0], rax
call fcn.14000a438
test eax, eax
jns 0x140007f95
mov ecx, 8
call fcn.140009b1c
call fcn.14000a718
test eax, eax
jns 0x140007fa8
mov ecx, 9
call fcn.140009b1c
mov ecx, edi
call fcn.140009b8c
test eax, eax
je 0x140007fba
mov ecx, eax
call fcn.140009b1c
mov r8, qword [0x14001ca78]
mov qword [0x14001caa8], r8
mov rdx, qword [0x14001ca70]
mov ecx, dword [0x14001ca6c]
call fcn.140003c64
mov edi, eax
mov dword [rsp + 0x24], eax
test ebx, ebx
jne 0x140007feb
mov ecx, eax
call fcn.140009f08
call fcn.140009b78
jmp 0x14000800d
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140008070
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
sub rsp, 0x28
call fcn.14018f000
add rsp, 0x28
jmp 0x140007e20