joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009ab0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x58], 0
jne 0x140009acb
jmp 0x140009c05
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x30], 4
mov rcx, qword [rsp + 0x50]
add rcx, 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DebugLogMaxSize
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x140009b22
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], 0x800000
mov dword [rsp + 0x30], 0x208
mov rcx, qword [rsp + 0x50]
add rcx, 0x220
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140106858]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x140009b7e
mov rcx, qword [rsp + 0x50]
add rcx, 0x220
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x140009b9b
mov rcx, qword [rsp + 0x50]
add rcx, 0x220
lea r8, [0x140106850]
mov edx, 0x104
call fcn.140007c70
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DebugLogTime
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x140009c05
cmp dword [rsp + 0x34], 1
jb 0x140009c05
cmp dword [rsp + 0x34], 0x3c
ja 0x140009c05
mov ecx, dword [rsp + 0x34]
imul ecx, ecx, 0xea60
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xec0], ecx
add rsp, 0x48
ret
Function at 0x140009c10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x38], 0
call fcn.14000a090
mov r9d, eax
mov rdx, qword [rsp + 0x60]
add rdx, 0xcb4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x140009d0e
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ErrLog
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x140009cec
cmp dword [rsp + 0x38], 1
jne 0x140009cec
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0xcac], 0
jne 0x140009ce2
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
call fcn.140009ab0
mov r11, qword [rsp + 0x60]
mov dword [r11 + 0xcac], 1
mov dword [rsp + 0x34], 1
jmp 0x140009d03
mov rax, qword [rsp + 0x60]
mov dword [rax + 0xcac], 0
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0xebc], 1
jne 0x140009d38
mov rdx, qword [rsp + 0x60]
add rdx, 0x220
mov r8d, 0x400
mov rcx, qword [rsp + 0x60]
call fcn.140009d50
mov eax, dword [rsp + 0x34]
add rsp, 0x58
ret

Function at 0x140009d50
Capabilities:
Query environment variable

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x258], rax
cmp qword [rsp + 0x278], 0
je 0x140009d8e
cmp dword [rsp + 0x280], 0
ja 0x140009d93
jmp 0x140009e6c
lea rax, str._ALLUSERSPROFILE_Application_DataAhnLabAIS
mov qword [rsp + 0x240], rax
mov rcx, qword [rsp + 0x270]
call fcn.140009e90
cmp eax, 1
jne 0x140009dc3
lea rax, str._PROGRAMDATA_AhnLabAIS
mov qword [rsp + 0x240], rax
xor eax, eax
mov word [rsp + 0x30], ax
lea rdi, [rsp + 0x32]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8d, 0x105
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x248], eax
cmp dword [rsp + 0x248], 0
jbe 0x140009e0f
mov dword [rsp + 0x250], 1
jmp 0x140009e1a
mov dword [rsp + 0x250], 0
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x24c], eax
cmp dword [rsp + 0x24c], 0
jne 0x140009e49
mov edx, 0x105
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov dword [rsp + 0x24c], eax
cmp dword [rsp + 0x24c], 0
je 0x140009e6c
mov edx, dword [rsp + 0x280]
lea r8, [rsp + 0x30]
mov rcx, qword [rsp + 0x278]
call fcn.140007c70
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.140103060
add rsp, 0x260
pop rdi
ret
Function at 0x140009f90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x220]
test eax, eax
jne 0x140009fb0
mov eax, 1
jmp 0x140009fe1
mov rcx, qword [rsp + 0x40]
add rcx, 0x220
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x140009fdf
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x140009fdf
mov eax, 1
jmp 0x140009fe1
xor eax, eax
add rsp, 0x38
ret

Function at 0x14000a500
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x480
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x478], rax
cmp qword [rsp + 0x490], 0
je 0x14000a53d
cmp dword [rsp + 0x498], 0
jne 0x14000a547
mov eax, 0x57
jmp 0x14000a6fd
movzx eax, byte [0x1401742a0]
movzx eax, al
test eax, eax
je 0x14000a585
mov edx, dword [rsp + 0x498]
lea r8, [0x140173aa0]
mov rcx, qword [rsp + 0x490]
call fcn.140007c70
mov rcx, qword [rsp + 0x490]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
xor eax, eax
jmp 0x14000a6fd
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14000c7d0
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14000a6ce
mov qword [rsp + 0x258], 0
call fcn.14000be30
mov r9d, eax
lea rax, [rsp + 0x258]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x250], eax
cmp dword [rsp + 0x250], 0
jne 0x14000a6ce
xor eax, eax
mov word [rsp + 0x260], ax
lea rdi, [rsp + 0x262]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x470], 0x208
lea rax, [rsp + 0x470]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.InstallPath
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x250], eax
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x250], 0
jne 0x14000a6ce
mov edx, dword [rsp + 0x498]
lea r8, [rsp + 0x260]
mov rcx, qword [rsp + 0x490]
call fcn.140007c70
lea r8, [rsp + 0x260]
mov edx, 0x400
lea rcx, [0x140173aa0]
call fcn.140007c70
mov byte [0x1401742a0], 1
mov rcx, qword [rsp + 0x490]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
xor eax, eax
jmp 0x14000a6fd
cmp qword [rsp + 0x4a0], 0
je 0x14000a6f8
mov r8d, dword [rsp + 0x498]
mov rdx, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x4a0]
call fcn.14000a720
jmp 0x14000a6fd
mov eax, 0x65b
mov rcx, qword [rsp + 0x478]
xor rcx, rsp
call fcn.140103060
add rsp, 0x480
pop rdi
ret
Function at 0x14000ac20
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x10c0
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x10b0], rax
cmp qword [rsp + 0x10d0], 0
jne 0x14000ac71
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14000adf8
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
xor r8d, r8d
mov edx, 0x400
lea rcx, [rsp + 0x40]
call fcn.14000a500
test eax, eax
je 0x14000aca3
xor eax, eax
jmp 0x14000adf8
xor eax, eax
mov word [rsp + 0x840], ax
lea rdi, [rsp + 0x842]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x10d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [0x140105ac0]
mov edx, 0x400
lea rcx, [rsp + 0x840]
call fcn.140008540
mov dword [rsp + 0x1040], 0
lea rdi, [rsp + 0x1044]
xor eax, eax
mov ecx, WSASetLastError
rep stosb byte [rdi], al
mov dword [rsp + 0x1040], 0x70
lea rax, [rsp + 0x840]
mov qword [rsp + 0x1058], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x1068], rax
mov rax, qword [rsp + 0x10d8]
mov qword [rsp + 0x1060], rax
mov dword [rsp + 0x1044], 0x440
mov dword [rsp + 0x1070], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.14000b9b0
test eax, eax
je 0x14000ad82
cmp dword [rsp + 0x10e8], 1
jne 0x14000ad82
lea rax, str.runas
mov qword [rsp + 0x1050], rax
lea rcx, [rsp + 0x1040]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x14000ad98
xor eax, eax
jmp 0x14000adf8
cmp dword [rsp + 0x10e0], 1
jne 0x14000adb5
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x10a8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x30], 0
cmp qword [rsp + 0x10a8], 0
je 0x14000adf3
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x10a8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x10a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
mov rcx, qword [rsp + 0x10b0]
xor rcx, rsp
call fcn.140103060
add rsp, 0x10c0
pop rdi
ret
Function at 0x14000b010
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
cmp qword [rsp + 0x90], 0
jne 0x14000b048
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14000b116
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.14000b7c0
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x14000b071
xor eax, eax
jmp 0x14000b116
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140010070
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000b0f8
mov dword [rsp + 0x7c], 1
jmp 0x14000b100
mov dword [rsp + 0x7c], 0
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x78], eax
lea rcx, [rsp + 0x50]
call fcn.1400100c0
mov eax, dword [rsp + 0x78]
add rsp, 0x88
ret

Function at 0x14000c0e0
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
cmp qword [rsp + 0x30], 0
je 0x14000c0fc
cmp dword [rsp + 0x38], 4
jae 0x14000c0fe
jmp 0x14000c157
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
test eax, eax
je 0x14000c157
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
movsxd rcx, eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + rcx*2]
cmp eax, 0x5c
jne 0x14000c157
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
movsxd rdx, eax
mov ecx, 0x5c
mov rax, qword [rsp + 0x30]
mov word [rax + rdx*2], cx
add rsp, 0x28
ret

Function at 0x14000f870
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x14000f883
xor eax, eax
test eax, eax
jne 0x14000f883
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x14000f8d7
mov eax, dword [rsp + 0x38]
jmp 0x14000f8e7
cmp dword [rsp + 0x30], 4
je 0x14000f8e5
mov eax, recv
jmp 0x14000f8e7
xor eax, eax
add rsp, 0x48
ret
Function at 0x14000fb90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x14000fba8
xor eax, eax
test eax, eax
jne 0x14000fba8
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
shl rax, 1
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x68]
mov dword [rax], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x14000fc10
mov eax, dword [rsp + 0x38]
jmp 0x14000fc93
cmp dword [rsp + 0x30], 1
je 0x14000fc25
cmp dword [rsp + 0x30], 2
je 0x14000fc25
mov eax, recv
jmp 0x14000fc93
cmp qword [rsp + 0x60], 0
je 0x14000fc79
cmp dword [rsp + 0x34], 0
je 0x14000fc6f
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
test rdx, rdx
jne 0x14000fc66
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, rax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax + rcx*2 - 2]
test eax, eax
je 0x14000fc6d
mov eax, recv
jmp 0x14000fc93
jmp 0x14000fc79
xor ecx, ecx
mov rax, qword [rsp + 0x60]
mov word [rax], cx
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
mov dword [rax], ecx
xor eax, eax
add rsp, 0x48
ret

Function at 0x14000fca0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x14000fcb8
xor eax, eax
test eax, eax
jne 0x14000fcb8
cmp qword [rsp + 0x60], 0
je 0x14000fcd6
mov dword [rsp + 0x34], 1
jmp 0x14000fcde
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14000fcf4
mov eax, recv
jmp 0x14000fd36
xor eax, eax
test eax, eax
jne 0x14000fcc4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x48
ret
Function at 0x140011620
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x2058
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x2048], rax
cmp qword [rsp + 0x2060], 0
jne 0x140011656
xor eax, eax
jmp 0x140011781
mov rax, qword [rsp + 0x2060]
movzx eax, word [rax]
test eax, eax
jne 0x14001166c
xor eax, eax
jmp 0x140011781
mov dword [rsp + 0x20], 0x1000
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [rsp + 0x2038], eax
mov eax, dword [rsp + 0x2038]
add eax, 1
mov ecx, eax
shl rcx, 1
call qword [sym.imp.MSVCR90.dll_malloc]
mov qword [rsp + 0x2030], rax
cmp qword [rsp + 0x2030], 0
jne 0x1400116b4
xor eax, eax
jmp 0x140011781
mov edx, dword [rsp + 0x2038]
add edx, 1
mov rcx, qword [rsp + 0x2030]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1400116f1
mov rcx, qword [rsp + 0x2030]
call qword [sym.imp.MSVCR90.dll_free]
mov qword [rsp + 0x2030], 0
xor eax, eax
jmp 0x140011781
mov r8, qword [rsp + 0x2030]
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call fcn.140007c70
lea r8, [0x140105cfc]
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call fcn.1400084c0
mov r8, qword [rsp + 0x2060]
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call fcn.1400084c0
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x2040], rax
mov rcx, qword [rsp + 0x2030]
call qword [sym.imp.MSVCR90.dll_free]
mov qword [rsp + 0x2030], 0
cmp qword [rsp + 0x2040], 0
je 0x14001177f
mov rax, qword [rsp + 0x2040]
jmp 0x140011781
xor eax, eax
mov rcx, qword [rsp + 0x2048]
xor rcx, rsp
call fcn.140103060
add rsp, 0x2058
ret
Function at 0x140012390
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0x50], 0x57
mov dword [rsp + 0x54], 0
mov dword [rsp + 0xb0], 0
mov dword [rsp + 0xb4], 0
mov byte [rsp + 0x70], 0
lea rdi, [rsp + 0x71]
xor eax, eax
mov ecx, 0x3f
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0
cmp qword [rsp + 0xd0], 0xffffffffffffffff
je 0x140012435
cmp qword [rsp + 0xd8], 0
je 0x140012435
cmp dword [rsp + 0xe0], 0
jle 0x140012435
cmp qword [rsp + 0xf0], 0
je 0x140012435
cmp qword [rsp + 0xf8], 0
ja 0x14001243f
jmp 0x1400125d1
mov eax, dword [rsp + 0xe0]
sub eax, 0x10
cdq
idiv dword [rsp + 0x100]
test edx, edx
jne 0x140012457
jmp 0x140012461
jmp 0x1400125d1
cmp dword [0x140178390], 0
jne 0x14001247c
mov dword [rsp + 0x50], 0x65b
jmp 0x1400125d1
mov dword [rsp + 0xb0], 0
jmp 0x1400124a0
mov ecx, dword [rsp + 0x100]
mov eax, dword [rsp + 0xb0]
add eax, ecx
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0xe0]
sub eax, 0x10
cmp dword [rsp + 0xb0], eax
jge 0x1400125c9
mov eax, dword [rsp + 0xb0]
mov r8d, dword [rsp + 0xe0]
sub r8d, eax
movsxd rax, dword [rsp + 0xb0]
mov rcx, qword [rsp + 0xd8]
add rcx, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x40
lea rdx, [rsp + 0x70]
call fcn.140015c00
test eax, eax
jne 0x140012537
mov dword [rsp + 0x50], 0x1770
jmp 0x1400125d1
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140012563
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
jmp 0x1400125d1
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xb4]
mov r8d, 0x40
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400125ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400125aa
mov dword [rsp + 0x50], 0x1d
jmp 0x1400125d1
cmp dword [rsp + 0xb4], 0x40
je 0x1400125c4
mov dword [rsp + 0x50], 0x1d
jmp 0x1400125d1
jmp 0x140012489
mov dword [rsp + 0x50], 0
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140103060
add rsp, 0xc0
pop rdi
ret
Function at 0x1400130f0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov dword [rsp + 0x50], 0
xor eax, eax
mov word [rsp + 0x58], ax
lea rdi, [rsp + 0x5a]
xor eax, eax
mov ecx, recv
rep stosb byte [rdi], al
cmp qword [rsp + 0x88], 0
je 0x14001313e
xor ecx, ecx
mov rax, qword [rsp + 0x88]
mov word [rax], cx
cmp qword [rsp + 0x80], 0
je 0x140013154
cmp qword [rsp + 0x88], 0
jne 0x14001315e
jmp 0x1400132f5
cmp dword [rsp + 0x98], 1
jne 0x1400131c9
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140013196
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140013196
jmp 0x1400131a0
jmp 0x1400132f5
mov edx, dword [rsp + 0x90]
mov r8, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.140007c70
mov dword [rsp + 0x50], 1
jmp 0x1400132f5
cmp dword [rsp + 0x98], 2
jne 0x140013249
mov edx, dword [rsp + 0x90]
mov r9, qword [rsp + 0x80]
lea r8, [0x140107f90]
mov rcx, qword [rsp + 0x88]
call fcn.140008540
test eax, eax
jge 0x140013204
jmp 0x1400132f5
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, 1
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14001323c
jmp 0x1400132f5
mov dword [rsp + 0x50], 1
jmp 0x1400132f5
cmp dword [rsp + 0x98], 3
jne 0x1400132f5
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r10d, word [rsp + 0x64]
movzx r9d, word [rsp + 0x62]
movzx r8d, word [rsp + 0x60]
movzx edi, word [rsp + 0x5e]
movzx ecx, word [rsp + 0x5a]
movzx eax, word [rsp + 0x58]
mov edx, dword [rsp + 0x90]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x80]
lea r8, [0x140107f50]
mov rcx, qword [rsp + 0x88]
call fcn.140008540
test eax, eax
jge 0x1400132c9
jmp 0x1400132f5
mov r8d, 1
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400132ed
jmp 0x1400132f5
mov dword [rsp + 0x50], 1
mov eax, dword [rsp + 0x50]
add rsp, 0x70
pop rdi
ret
Function at 0x140013310
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov dword [rsp + 0x50], 0
xor eax, eax
mov word [rsp + 0x58], ax
lea rdi, [rsp + 0x5a]
xor eax, eax
mov ecx, recv
rep stosb byte [rdi], al
cmp qword [rsp + 0x88], 0
je 0x14001335c
mov rax, qword [rsp + 0x88]
mov byte [rax], 0
cmp qword [rsp + 0x80], 0
je 0x140013372
cmp qword [rsp + 0x88], 0
jne 0x14001337c
jmp 0x140013513
cmp dword [rsp + 0x98], 1
jne 0x1400133e7
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1400133b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400133b4
jmp 0x1400133be
jmp 0x140013513
mov edx, dword [rsp + 0x90]
mov r8, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.140016610
mov dword [rsp + 0x50], 1
jmp 0x140013513
cmp dword [rsp + 0x98], 2
jne 0x140013467
mov edx, dword [rsp + 0x90]
mov r9, qword [rsp + 0x80]
lea r8, str._s.old.log
mov rcx, qword [rsp + 0x88]
call fcn.140016770
test eax, eax
jge 0x140013422
jmp 0x140013513
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r8d, 1
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x14001345a
jmp 0x140013513
mov dword [rsp + 0x50], 1
jmp 0x140013513
cmp dword [rsp + 0x98], 3
jne 0x140013513
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r10d, word [rsp + 0x64]
movzx r9d, word [rsp + 0x62]
movzx r8d, word [rsp + 0x60]
movzx edi, word [rsp + 0x5e]
movzx ecx, word [rsp + 0x5a]
movzx eax, word [rsp + 0x58]
mov edx, dword [rsp + 0x90]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x80]
lea r8, str._s._.4d_.2d_.2d_.2d_.2d_.2d.log
mov rcx, qword [rsp + 0x88]
call fcn.140016770
test eax, eax
jge 0x1400134e7
jmp 0x140013513
mov r8d, 1
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x14001350b
jmp 0x140013513
mov dword [rsp + 0x50], 1
mov eax, dword [rsp + 0x50]
add rsp, 0x70
pop rdi
ret