joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400022c0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rsp + 0x90]
lea ebp, [rdx + 0x61e]
mov edi, ecx
lea eax, [rbp + 0x17]
xor edi, 0x8f3
lea r13d, [rdx + 0xa5]
add ecx, 0xfffff78a
lea r14d, [rdx + 0x2cf]
lea r15d, [r9 - 0x20ec]
lea esi, [rdx - 0x20ec]
cmp ecx, eax
je 0x140002370
lea eax, [rcx + 0xb78]
cmp esi, eax
je 0x140002370
mov eax, dword [rbx + 0x128]
lea r10d, [rbp - 0xa3]
add eax, 0xefe22
lea r9d, [rcx + 0x192]
xor dword [rbx + 0x124], eax
lea r8d, [r14 + 0x8a9]
lea eax, [r15 + 0x27a3]
add ecx, 0x61e
mov dword [rsp + 0x30], eax
lea edx, [rsi + 0x2962]
mov dword [r11 - 0x40], r10d
mov qword [r11 - 0x48], rbx
call fcn.140001a94
mov edi, eax
lea ecx, [rdi - 0x13c]
cmp ebp, ecx
jl 0x140002442
lea ecx, [r14 + 0x5a7]
cmp r15d, ecx
jg 0x1400023b5
mov ecx, dword [rbx + 0x100]
xor ecx, 0x37e10cbe
mov dword [rbx + 8], ecx
mov eax, dword [rbx + 0x108]
sub eax, dword [rbx + 0xf4]
add eax, 0x8833
mov dword [0x14022e040], eax
jmp 0x140002442
mov ecx, dword [rbx + 0x110]
mov r12d, dword [rbx + 0x78]
add ecx, esi
cmp r12d, ecx
je 0x140002442
mov r14d, r13d
or r14d, 0x2191
mov eax, dword [rbx + 0x28]
mov r9d, r15d
sub r9d, dword [rbx + 0xe0]
mov edx, dword [rbx + 0x144]
or r9d, r13d
imul eax, r14d
add edx, 0x78
mov dword [rbx + 0x28], eax
mov rax, qword [section..data]
imul r10d, dword [rbx + 0x74], 0x2c64
mov ecx, dword [rax + 0xf8]
mov r8d, dword [rax + 0x13c]
lea rax, [0x14022e010]
or ecx, dword [rbx + 0x60]
or r10d, esi
mov qword [rsp + 0x28], rax
or ecx, 0x2962
xor r8d, ebp
mov dword [rsp + 0x20], r10d
call fcn.140011f3c
mov ecx, dword [rbx + 0x110]
add r12d, 3
add ecx, esi
cmp r12d, ecx
jne 0x1400023d0
lea r11, [rsp + 0x40]
xor edi, 0xbc7
mov rbx, qword [r11 + 0x30]
mov eax, edi
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000ad34
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14000ad11
call fcn.140009a04
mov dword [rax], 0x16
call fcn.1400098e4
or eax, 0xffffffff
jmp 0x14000ad2e
sub dword [rcx + 0x10], 1
jns 0x14000ad20
add rsp, 0x28
jmp 0x14000daec
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14000acf0
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14000d98c
call fcn.140009a04
mov dword [rax], 0x16
call fcn.1400098e4
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14000d974
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14000d974
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14000d9be
lock or dword [rax + 0x14], 0x10
jmp 0x14000d974
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14000d9db
mov rcx, qword [rbp + 0x10]
call fcn.14000daf4
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000ab34
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14000e940
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14000da32
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14000d974
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14000da9e
mov rcx, qword [rbp + 0x10]
call fcn.14000ab34
cmp eax, 0xffffffff
je 0x14000da85
mov rcx, qword [rbp + 0x10]
call fcn.14000ab34
cmp eax, 0xfffffffe
je 0x14000da85
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000ab34
movsxd rdi, eax
lea rsi, [0x14060b470]
mov rcx, rbx
sar rdi, 6
call fcn.14000ab34
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14000da8c
lea rax, [0x14060a8e0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14000da9e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14000dad4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14000dad0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14000dad0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14000d977
jmp 0x14000d944
Function at 0x140010b88
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x40
mov edi, dword [rsp + 0x70]
lea esi, [r9 + 0xad3]
mov eax, dword [rsp + 0x78]
lea r14d, [rcx + 0xa3]
mov ebp, edi
xor eax, 0x418
xor ebp, 0x2122
xor edi, 0xd46
cmp ebp, eax
jge 0x140010cb2
mov eax, edi
xor eax, 0x506
cmp r14d, eax
je 0x140010cf9
mov rax, qword [section..data]
lea r9d, [rsi - 0x981]
mov rbx, qword [rsp + 0x80]
lea edx, [rdi - 0x302]
mov r8d, ebp
xor r8d, 0x22e3
mov ecx, dword [rax + 0x68]
mov eax, edi
sub ecx, dword [rbx + 0xf8]
xor eax, 0xdf5
sub ecx, 0xacb9c
mov dword [r11 - 0x20], r8d
mov dword [rbx + 0x18], ecx
mov r8, rbx
lea ecx, [r14 - 0x505]
mov dword [rsp + 0x20], eax
call fcn.140001e9c
mov r8d, dword [0x14022e080]
xor ecx, ecx
mov r9d, dword [0x14022e158]
add r8d, 0x2ffe
add r8d, dword [rbx + 0x100]
add r9d, 0x40
mov edx, dword [0x14022e028]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r8d, [rbp + 0x270a]
xor r14d, 0x3a9
add rax, 0x1800
lea ecx, [rdi - 0xa5f]
mov qword [rbx + 0xc8], rax
xor ebp, 0x2962
lea eax, [rsi - 0x543]
mov r9, rbx
mov dword [rsp + 0x30], eax
xor esi, 0xd46
mov dword [rsp + 0x28], r14d
mov edx, ebp
mov dword [rsp + 0x20], esi
call fcn.1400026dc
jmp 0x140010cf9
mov rax, qword [section..data]
mov ecx, dword [rax + 0x24]
xor ecx, dword [0x14022e110]
cmp esi, ecx
jne 0x140010cf9
mov edx, 0x2afb
mov ecx, 0x61d
mov r8d, 0x38fc
call fcn.140012f60
mov rcx, qword [section..data]
add esi, 3
mov word [0x14060b244], ax
mov edx, dword [rcx + 0x24]
xor edx, dword [0x14022e110]
cmp esi, edx
je 0x140010cc6
mov rbx, qword [rsp + 0x50]
xor edi, 0xd46
mov rbp, qword [rsp + 0x58]
mov eax, edi
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x140011100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r9d, dword [rsp + 0x60]
lea ecx, [r8 + 0x82]
mov r11d, dword [rsp + 0x68]
lea eax, [rdx + 0x366]
xor r9d, 0x2667
lea ebx, [r8 - 0x2721]
add r11d, 0xffffdefb
lea edi, [rdx + 0x8a9]
cmp ecx, eax
je 0x1400112fe
lea eax, [rcx - 0x69e]
cmp r9d, eax
jg 0x14001135e
mov r10, qword [rsp + 0x70]
lea rax, [0x140263eb0]
add r9d, 0x22e3
xor r11d, r11d
mov qword [r10 + 0x80], rax
mov ecx, dword [r10 + 4]
xor ecx, dword [r10 + 0x108]
mov eax, dword [r10 + 0x50]
inc ecx
imul eax, ecx
mov dword [r10 + 0x50], eax
mov eax, dword [r10 + 0xc0]
mov ecx, dword [r10 + 0x38]
xor ecx, dword [0x14022e03c]
sub ecx, 0xe1e14
imul eax, ecx
mov ecx, dword [r10 + 0x28]
mov dword [r10 + 0xc0], eax
sub ecx, dword [r10 + 0xd8]
mov r8, qword [section..data]
xor ecx, 0xffffffec
mov rax, qword [r8 + 0x80]
mov edx, dword [r11 + rax]
add r11, 4
mov eax, dword [r8 + 0xd8]
imul eax, ecx
mov dword [r8 + 0xd8], eax
movsxd rcx, dword [r10 + 0x48]
movzx eax, dl
movzx edx, byte [r10 + 0x44]
imul edx, eax
mov rax, qword [0x14022e0b8]
mov byte [rcx + rax], dl
inc dword [r10 + 0x48]
mov ecx, dword [r10 + 0x70]
mov eax, dword [r10 + 0xbc]
sub eax, dword [0x14022e0a8]
add eax, 0x171a4e
add dword [r10 + 0xa4], eax
mov eax, dword [r10 + 0xd8]
sub eax, 0x13
add dword [r10 + 0x138], eax
mov rax, qword [section..data]
sub ecx, dword [rax + 0x28]
mov eax, dword [0x14022e060]
dec ecx
imul eax, ecx
mov dword [0x14022e060], eax
mov eax, 0x54
sub eax, dword [r10 + 0x68]
add dword [r10 + 0x70], eax
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x138]
sub dword [rcx + 0x100], eax
mov ecx, dword [0x14022e104]
mov eax, dword [0x14022e098]
xor eax, 0xfffad84e
imul ecx, eax
mov eax, dword [0x14022e118]
sub eax, dword [0x14022e078]
add eax, 0x54
mov dword [0x14022e104], ecx
add dword [r10 + 0x108], eax
mov eax, dword [0x14022e03c]
mov ecx, dword [r10 + 0x10c]
add eax, 0xfffda7af
imul ecx, eax
mov eax, dword [r10 + 0xa4]
mov dword [r10 + 0x10c], ecx
xor dword [r10 + 4], eax
mov eax, dword [r10 + 0xd8]
add eax, dword [0x14022e048]
xor eax, dword [r10 + 0x138]
xor eax, 0xc465a
mov dword [r10 + 0x138], eax
mov eax, dword [r10 + 0x144]
xor eax, dword [0x14022e0e8]
sub eax, 0x13
or dword [r10 + 0x68], eax
cmp r11, 0x39d500
jl 0x140011170
jmp 0x14001135e
mov r10, qword [rsp + 0x70]
mov ecx, dword [r10 + 0x2c]
add ecx, r11d
cmp dword [r10 + 0x144], ecx
jb 0x14001135e
mov rax, qword [section..data]
mov edx, ebx
imul r9d, edi, 0x2105
or edx, 0x2962
sub edx, dword [r10 + 0x118]
mov rcx, r10
mov r8d, dword [rax + 0x28]
lea eax, [r11 - 0x270a]
imul eax, ebx
add r8d, edi
xor r8d, 0x2122
xor r9d, 0x2667
mov dword [rsp + 0x20], eax
call fcn.140001200
mov r9d, eax
lea eax, [r9 + 0x1c0]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140134e40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov eax, dword [0x140296248]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
movzx eax, byte [rax + 0x48]
test eax, eax
je 0x140134e70
cmp eax, 1
je 0x140134ea6
xor eax, eax
jmp 0x140134f96
mov eax, dword [0x140296248]
mov rdx, qword gs:[0x58]
mov rdi, qword [rdx + rax*8]
lea rax, [rdi + 0x18]
lea rdx, [0x140134fa0]
mov rsi, rcx
mov rcx, rax
call fcn.140189790
mov rcx, rsi
mov byte [rdi + 0x48], 1
movaps xmm0, xmmword [0x1401fb7a0]
mov al, 1
test rcx, rcx
je 0x140134ee0
cmp qword [rcx], 0
mov qword [rcx], 0
je 0x140134ee0
movups xmm0, xmmword [rcx + 8]
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rsp + 0x60], xmm1
movzx eax, byte [rcx + 0x28]
mov edx, dword [rcx + 0x2c]
mov dword [rsp + 0x2b], edx
mov ecx, dword [rcx + 0x29]
mov dword [rsp + 0x28], ecx
mov ecx, dword [0x140296248]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x38]
movaps xmmword [rsp + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x28]
movaps xmmword [rsp + 0x40], xmm1
mov qword [rcx + 0x18], 1
movups xmmword [rcx + 0x20], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rcx + 0x30], xmm0
mov byte [rcx + 0x40], al
mov eax, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2b]
mov dword [rcx + 0x44], edx
mov dword [rcx + 0x41], eax
cmp qword [rsp + 0x30], 0
je 0x140134f7c
mov rax, qword [rsp + 0x40]
cmp rax, 2
je 0x140134f7c
test rax, rax
je 0x140134f7c
mov rax, qword [rsp + 0x48]
lock dec qword [rax]
jne 0x140134f7c
lea rcx, [rsp + 0x48]
call fcn.14000b290
mov eax, dword [0x140296248]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rax, [rax + 0x20]
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400018f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140001968
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140001968
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140001955
nop
cmp rbx, rcx
jae 0x140001968
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140001940
cmp rbx, rcx
jae 0x140001968
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x14000196a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140003200
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x820
mov rdi, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x800
call fcn.14005fd20
mov rax, qword [rsi]
mov bpl, 1
cmp dword [rax - 0x10], 0
jne 0x14000333d
mov qword [rsp + 0x830], rbx
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov qword [rsp + 0x838], r14
mov rcx, rsi
call fcn.140003140
test al, al
je 0x1400032fb
cmp word [rsp + 0x20], 0
je 0x1400032fb
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x20]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140003280
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140002da0
mov rcx, qword [rdi]
cmp dword [rcx - 0x10], 0
jl 0x140003306
lea r14, str.logs
mov rdx, r14
call fcn.1400407c8
test rax, rax
je 0x140003306
mov rcx, qword [rdi]
sub rax, rcx
sar rax, 1
cmp eax, ebx
je 0x140003306
movsxd rcx, dword [rcx - 0x10]
sub rcx, 4
cdqe
cmp rax, rcx
jae 0x140003306
mov rcx, rdi
call fcn.140011770
nop dword [rax]
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x1400032e0
mov r8d, ebx
mov rdx, r14
mov rcx, rdi
call fcn.140002b60
jmp 0x140003306
mov rdx, rdi
call fcn.140003370
xor bpl, bpl
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [rsp + 0x838]
mov rbx, qword [rsp + 0x830]
cmp eax, 0xffffffff
jne 0x140003332
mov rdx, qword [rdi]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rdx, rdi
mov rcx, rsi
call fcn.140004960
mov rdx, rsi
mov rcx, rdi
call fcn.140004960
lea r11, [rsp + 0x820]
movzx eax, bpl
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140003370
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x820
mov rdi, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x800
call fcn.14005fd20
call fcn.14002fc90
mov ecx, 0x23
lea rdx, [rsp + 0x20]
test al, al
mov r8d, 0x1c
cmovne r8d, ecx
lea r9d, [rcx - 0x22]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14000346b
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x20]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x1400033d0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140002da0
mov rcx, rdi
call fcn.140011770
lea rdx, str.ProcessLasso
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140003400
mov rcx, rdi
call fcn.140002b60
mov rcx, rdi
call fcn.140011770
lea rdx, str.logs
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140003422
mov r8d, ebx
mov rcx, rdi
call fcn.140002b60
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140003453
mov rdx, qword [rdi]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rax, qword [rdi]
movsxd rax, dword [rax - 0x10]
mov rbx, qword [rsp + 0x838]
add rsp, 0x820
pop rdi
ret
mov rax, qword [rdi]
cmp dword [rax - 0x10], 0
lea rdx, [rax - 0x18]
mov qword [rsp + 0x830], rsi
mov rsi, qword [rdx]
je 0x1400034c6
cmp dword [rdx + 0x10], 0
jge 0x14000349c
cmp dword [rax - 0xc], 0
jl 0x1400034e1
xor ecx, ecx
mov dword [rax - 0x10], ecx
mov rax, qword [rdi]
mov word [rax], cx
jmp 0x1400034c6
mov rbx, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400034b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov rsi, qword [rsp + 0x830]
xor eax, eax
mov rbx, qword [rsp + 0x838]
add rsp, 0x820
pop rdi
ret
mov ecx, 0x80070057
call fcn.1400018b0
int3

Function at 0x140005020
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
movzx edi, dl
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x1400050e7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rsi, str.UpdateChecksEnabled
mov rbx, 0xffffffffffffffff
cmp rsi, 0x10000
jae 0x14000507d
movzx edx, si
lea rcx, [rsp + 0x30]
call fcn.140002950
jmp 0x140005099
mov r8, rbx
inc r8
cmp word [rsi + r8*2], 0
jne 0x140005080
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140002da0
nop
lea rdx, [rsp + 0x30]
lea rcx, [0x140086bc8]
call fcn.140010c20
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400050c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, edi
mov rdx, rsi
lea rcx, [0x140086bb0]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400106d0
mov ecx, 0x80004005
call fcn.1400018b0
int3
Function at 0x140005100
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x1400051c5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdi, str.UpdatePromptless
mov rbx, 0xffffffffffffffff
cmp rdi, 0x10000
jae 0x140005155
movzx edx, di
lea rcx, [rsp + 0x30]
call fcn.140002950
jmp 0x140005179
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x140005160
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140002da0
nop
lea rdx, [rsp + 0x30]
lea rcx, [0x140086bc8]
call fcn.140010c20
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400051a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 1
mov rdx, rdi
lea rcx, [0x140086bb0]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400106d0
mov ecx, 0x80004005
call fcn.1400018b0
int3

Function at 0x1400051d0
Capabilities:
Identify system language via api
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov rbx, qword [0x140086d28]
mov r8d, 0x409
movzx r9d, ax
mov ecx, dword [rbx + 0x1024]
test ecx, ecx
je 0x14000521f
mov r10d, 0x3ff
mov edx, r8d
and r9w, r10w
and cx, r10w
cmp cx, r9w
je 0x140005245
mov eax, dword [rbx + rdx*4 + 4]
inc rdx
inc r8d
movzx ecx, ax
test eax, eax
jne 0x140005204
call fcn.140015b90
mov ebx, eax
test eax, eax
je 0x140005235
mov dword [0x140086d30], eax
call fcn.140015e30
mov dword [0x14007fcb0], ebx
add rsp, 0x20
pop rbx
jmp fcn.140005260
movsxd rax, r8d
mov ebx, dword [rbx + rax*4]
mov dword [0x14007fcb0], ebx
add rsp, 0x20
pop rbx
jmp fcn.140005260
Function at 0x1400068e0
Capabilities:
Check if file exists
Delete directory
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x820
mov rbp, rcx
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140006b1f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x848], rax
lea r14, str.prolasso.log
mov rsi, 0xffffffffffffffff
cmp r14, 0x10000
jae 0x140006945
movzx edx, r14w
lea rcx, [rsp + 0x848]
call fcn.140002950
jmp 0x14000696c
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x140006950
mov rdx, r14
lea rcx, [rsp + 0x848]
call fcn.140002da0
nop
lea rdx, str..csv
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140006980
lea rcx, [rsp + 0x848]
call fcn.140002b60
xor r8d, r8d
mov rdi, qword [rsp + 0x848]
mov rdx, rdi
mov rcx, rbp
call fcn.140006700
xor r8d, r8d
mov rdx, r14
mov rcx, rbp
call fcn.140006700
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x20]
call fcn.14005fd20
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x140006ae5
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140006b14
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x850], rax
lea rax, [rsp + 0x20]
cmp rax, 0x10000
lea rax, [rsp + 0x20]
jae 0x140006a31
movzx edx, ax
lea rcx, [rsp + 0x850]
call fcn.140002950
jmp 0x140006a52
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x140006a34
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x850]
call fcn.140002da0
nop
lea rcx, [rsp + 0x850]
call fcn.140011770
lea rdx, str.ProcessLassologs
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140006a70
lea rcx, [rsp + 0x850]
call fcn.140002b60
mov rbx, qword [rsp + 0x850]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140006ac4
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
call fcn.140006700
mov r8, rbx
mov rdx, r14
mov rcx, rbp
call fcn.140006700
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140006add
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x848]
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140006afc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
int3
Function at 0x1400102a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx ebp, r8b
mov rbx, rdx
mov rsi, rcx
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14001036f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov rdi, 0xffffffffffffffff
test rbx, rbx
je 0x140010312
cmp rbx, 0x10000
jae 0x140010302
movzx edx, bx
lea rcx, [rsp + 0x48]
call fcn.140002950
jmp 0x140010323
mov r8, rdi
inc r8
cmp word [rbx + r8*2], 0
jne 0x140010305
jmp 0x140010315
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140002da0
nop
lea rcx, [rsi + 0x18]
lea rdx, [rsp + 0x48]
call fcn.140010c20
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14001034d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400106d0
mov ecx, 0x80004005
call fcn.1400018b0
int3

Function at 0x140010380
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x20
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140010424
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rbx, str.ProBalanceDefaultsApplied
lea rcx, [rsp + 0x38]
cmp rbx, 0x10000
jae 0x1400103c9
movzx edx, bx
call fcn.140002950
jmp 0x1400103d8
mov r8d, 0x19
mov rdx, rbx
call fcn.140002da0
nop
lea rdx, [rsp + 0x38]
lea rcx, [0x140086d68]
call fcn.140010c20
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001040a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0x134d7bb
mov rdx, rbx
lea rcx, [0x140086d40]
add rsp, 0x20
pop rbx
jmp fcn.1400106d0
mov ecx, 0x80004005
call fcn.1400018b0
int3