joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400138c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0xffffffffffffffff
mov dword [rsp + 0x50], 0
cmp qword [rsp + 0x70], 0
jne 0x1400138f4
jmp 0x140013a21
mov r8d, 0x2c
xor edx, edx
mov rcx, qword [rsp + 0x70]
call sub.MSVCR90.dll_memset
cmp dword [0x140178390], 0
jne 0x140013919
jmp 0x140013a21
cmp dword [0x1401787a8], 1
jne 0x14001395a
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, [0x14017859e]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
jmp 0x140013990
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, [0x140178499]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 0x2c
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400139bc
jmp 0x140013a21
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0xffffffffffffffff
mov rcx, qword [rsp + 0x70]
call fcn.140013a50
test eax, eax
jne 0x1400139ed
mov ecx, recv
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140013a21
mov rcx, qword [rsp + 0x70]
add rcx, 0x1b
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
call fcn.140014010
test eax, eax
jne 0x140013a19
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140013a21
mov dword [rsp + 0x40], 1
cmp qword [rsp + 0x48], 0xffffffffffffffff
je 0x140013a3d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0xffffffffffffffff
mov eax, dword [rsp + 0x40]
add rsp, 0x68
ret
Function at 0x140013a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0
mov byte [rsp + 0x28], 0
cmp qword [rsp + 0x40], 0
jne 0x140013a80
jmp 0x140013b8e
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x19]
test eax, eax
jne 0x140013a97
jmp 0x140013b8e
mov rcx, qword [rsp + 0x40]
add rcx, 8
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [0x1401787c0]
call sub.MSVCR90.dll_memcmp
test eax, eax
je 0x140013ac0
jmp 0x140013b8e
mov rax, qword [rsp + 0x40]
movsx eax, byte [rax]
cmp eax, 0x73
jne 0x140013b23
mov rax, qword [rsp + 0x40]
movsx eax, byte [rax + 1]
cmp eax, 0x6c
jne 0x140013b23
mov rax, qword [rsp + 0x40]
movsx eax, byte [rax + 2]
cmp eax, 0x70
jne 0x140013b23
mov rax, qword [rsp + 0x40]
movsx eax, byte [rax + 3]
cmp eax, 0x6b
jne 0x140013b23
mov rax, qword [rsp + 0x40]
movsx eax, byte [rax + 4]
cmp eax, 0x20
jne 0x140013b23
mov rax, qword [rsp + 0x40]
movsx eax, byte [rax + 5]
cmp eax, 0x61
jne 0x140013b23
mov rax, qword [rsp + 0x40]
movsx eax, byte [rax + 6]
cmp eax, 0x30
jne 0x140013b23
jmp 0x140013b27
jmp 0x140013b8e
mov dword [rsp + 0x20], 9
jmp 0x140013b3c
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0x2b
jae 0x140013b62
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + rcx]
movzx eax, byte [rsp + 0x28]
add eax, ecx
mov byte [rsp + 0x28], al
jmp 0x140013b31
movzx eax, byte [rsp + 0x28]
xor eax, 0xf4
mov byte [rsp + 0x28], al
movzx ecx, byte [rsp + 0x28]
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x2b]
cmp ecx, eax
je 0x140013b86
jmp 0x140013b8e
mov dword [rsp + 0x24], 1
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret

Function at 0x140013ba0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
cmp qword [rsp + 0x50], 0xffffffffffffffff
je 0x140013bce
cmp qword [rsp + 0x58], 0
jne 0x140013bd2
jmp 0x140013c22
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140013bee
jmp 0x140013c22
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, 0x80
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140013c1a
jmp 0x140013c22
mov dword [rsp + 0x30], 1
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140013c40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
cmp qword [rsp + 0x58], 0
je 0x140013c78
mov r8d, 0x80
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.MSVCR90.dll_memset
cmp qword [rsp + 0x50], 0xffffffffffffffff
je 0x140013c88
cmp qword [rsp + 0x58], 0
jne 0x140013c92
jmp 0x140013dc3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140013cb4
jmp 0x140013dc3
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, 0x80
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140013ce6
jmp 0x140013dc3
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 0x1d]
test eax, eax
jg 0x140013cfd
jmp 0x140013dc3
mov rcx, qword [rsp + 0x58]
add rcx, 0xc
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [0x1401787c0]
call sub.MSVCR90.dll_memcmp
test eax, eax
je 0x140013d26
jmp 0x140013dc3
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax]
cmp eax, 0x41
jne 0x140013db7
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax + 1]
cmp eax, 0x53
jne 0x140013db7
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax + 2]
cmp eax, 0x4c
jne 0x140013db7
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax + 3]
cmp eax, 0x46
jne 0x140013db7
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax + 4]
cmp eax, 0x49
jne 0x140013db7
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax + 5]
cmp eax, 0x4c
jne 0x140013db7
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax + 6]
cmp eax, 0x45
jne 0x140013db7
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax + 7]
cmp eax, 0x31
jne 0x140013db7
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax + 8]
cmp eax, 0x2e
jne 0x140013db7
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax + 9]
cmp eax, 0x30
jne 0x140013db7
jmp 0x140013dbb
jmp 0x140013dc3
mov dword [rsp + 0x30], 1
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140015760
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x48], 0
cmp qword [rsp + 0x78], 0
je 0x1400157b7
xor ecx, ecx
mov rax, qword [rsp + 0x78]
mov word [rax], cx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x140108078]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1400157f3
cmp qword [rsp + 0x38], 0
je 0x1400157f3
jmp 0x1400157fd
jmp 0x140015927
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401068d8]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001583f
jmp 0x140015927
cmp dword [rsp + 0x50], 1
je 0x140015850
jmp 0x140015927
cmp qword [rsp + 0x70], 0
je 0x14001591f
cmp qword [rsp + 0x78], 0
je 0x14001591f
cmp qword [rsp + 0x80], 0
jbe 0x14001591f
mov eax, dword [rsp + 0x80]
lea rax, [rax + rax - 2]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140106858]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140015908
mov dx, 0x5c
mov rcx, qword [rsp + 0x70]
call fcn.14000f640
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1400158d6
jmp 0x140015927
mov rax, qword [rsp + 0x48]
movzx eax, word [rax + 2]
test eax, eax
jne 0x1400158e7
jmp 0x140015927
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call fcn.1400084c0
test eax, eax
jge 0x140015906
jmp 0x140015927
jmp 0x14001591f
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call fcn.140007c70
mov dword [rsp + 0x40], 1
cmp qword [rsp + 0x38], 0
je 0x140015943
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x40]
add rsp, 0x68
ret
Function at 0x140015960
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x48], 0
cmp qword [rsp + 0x78], 0
je 0x1400159b5
mov rax, qword [rsp + 0x78]
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareAhnLabACA
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1400159f1
cmp qword [rsp + 0x38], 0
je 0x1400159f1
jmp 0x1400159fb
jmp 0x140015b25
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DebugLog
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x140015a3d
jmp 0x140015b25
cmp dword [rsp + 0x50], 1
je 0x140015a4e
jmp 0x140015b25
cmp qword [rsp + 0x70], 0
je 0x140015b1d
cmp qword [rsp + 0x78], 0
je 0x140015b1d
cmp qword [rsp + 0x80], 0
jbe 0x140015b1d
mov eax, dword [rsp + 0x80]
sub rax, 1
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DebugLogPath
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140015b06
mov edx, 0x5c
mov rcx, qword [rsp + 0x70]
call fcn.1400167f0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140015ad4
jmp 0x140015b25
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax + 1]
test eax, eax
jne 0x140015ae5
jmp 0x140015b25
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call fcn.140016680
test eax, eax
jge 0x140015b04
jmp 0x140015b25
jmp 0x140015b1d
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call fcn.140016610
mov dword [rsp + 0x40], 1
cmp qword [rsp + 0x38], 0
je 0x140015b41
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x40]
add rsp, 0x68
ret

Function at 0x140015e80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x30], 0
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
cmp qword [rsp + 0x270], 0
jne 0x140015ecc
jmp 0x140015f1c
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140015ee4
jmp 0x140015f1c
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [0x140105ac0]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140008540
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140103060
add rsp, 0x260
pop rdi
ret
Function at 0x140015f40
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x160
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x40], 0
lea rdi, [rsp + 0x41]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
cmp qword [rsp + 0x170], 0
jne 0x140015f8a
jmp 0x140015fe2
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x140015fa2
jmp 0x140015fe2
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140016770
test eax, eax
jge 0x140015fd2
jmp 0x140015fe2
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140103060
add rsp, 0x160
pop rdi
ret

Function at 0x140016900
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x840
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x838], rax
cmp qword [rsp + 0x858], 0
jne 0x140016936
xor eax, eax
jmp 0x140016aaa
xor eax, eax
mov word [rsp + 0x30], ax
lea rdi, [rsp + 0x32]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x858]
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.140007c70
lea rdx, str.PdCfg.dll
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [rsp + 0x830], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdx, rax
mov rax, qword [rsp + 0x850]
mov qword [rax], rdx
mov rax, qword [rsp + 0x850]
cmp qword [rax], 0
je 0x140016aa3
lea rdx, str.B4810203714C47f9BFD73684A92A2C1E
mov rcx, qword [rsp + 0x850]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rax, qword [rsp + 0x850]
mov qword [rax + 8], rdx
lea rdx, str.CCDF4192812041dfA8DACC3CBB9DC580
mov rcx, qword [rsp + 0x850]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rax, qword [rsp + 0x850]
mov qword [rax + 0x10], rdx
lea rdx, str.D5B387C9DE8F4e50BCFFA929BBF11CC8
mov rcx, qword [rsp + 0x850]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rax, qword [rsp + 0x850]
mov qword [rax + 0x18], rdx
lea rdx, str.F4265D584B2B43539CA86DEB0DCBA606
mov rcx, qword [rsp + 0x850]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rax, qword [rsp + 0x850]
mov qword [rax + 0x20], rdx
lea rdx, str.A125FF8C57D44c5cA3E46E28A664B999
mov rcx, qword [rsp + 0x850]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov rax, qword [rsp + 0x850]
mov qword [rax + 0x28], rdx
mov rcx, qword [rsp + 0x850]
call fcn.140016b70
test eax, eax
jne 0x140016a98
mov rcx, qword [rsp + 0x850]
call fcn.140016ad0
mov dword [rsp + 0x830], 0
jmp 0x140016aa3
mov dword [rsp + 0x830], 1
mov eax, dword [rsp + 0x830]
mov rcx, qword [rsp + 0x838]
xor rcx, rsp
call fcn.140103060
add rsp, 0x840
pop rdi
ret
Function at 0x140017fa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [rcx + 0x430]
test eax, eax
je 0x140017e60
dec eax
mov dword [rcx + 0x430], eax
jne 0x140017e60
mov eax, dword [rcx + 0x42c]
mov dword [rcx + 0x428], eax
repz ret
push rbx
sub rsp, 0x30
mov rbx, rcx
test edx, edx
je 0x140017fb5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x140017fce
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [rbx + 0x14]
cmp eax, edx
jb 0x140017fce
mov ecx, eax
sub ecx, edx
cmp ecx, 0x927c0
jb 0x14001801b
lea r8, [0x1401068d8]
lea rdx, str.SoftwareAhnLabAhnInst
xor r9d, r9d
mov rcx, 0xffffffff80000002
mov dword [rbx + 0x14], eax
mov dword [rsp + 0x20], 1
call fcn.14001be20
xor ecx, ecx
test eax, eax
setne cl
cmp dword [rbx + 0x10], ecx
je 0x14001801b
mov dword [rbx + 0x10], ecx
test ecx, ecx
mov rcx, rbx
je 0x140018016
add rsp, 0x30
pop rbx
jmp 0x140017e40
call fcn.140017e10
add rsp, 0x30
pop rbx
ret
Function at 0x14001bdb0
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx + 8]
call qword [sym.imp.MSVCR90.dll__get_osfhandle]
mov rcx, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_SetEndOfFile]

Function at 0x14001be20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov eax, dword [rsp + 0x70]
mov edi, r9d
mov rbx, r8
lea r9, [rsp + 0x38]
mov r8d, 1
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x20], eax
call fcn.14001bdf0
test eax, eax
jne 0x14001be98
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14001be98
cmp dword [rsp + 0x30], 4
mov eax, dword [rsp + 0x34]
je 0x14001be9a
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14001c308
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
mov eax, 1
ja 0x14001c35c
jne 0x14001c35a
cmp dword [rsp + 0x28], eax
jae 0x14001c35c
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140103060
add rsp, 0x158
ret

Function at 0x14001c440
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x460
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
lea rcx, [rsp + 0x32]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], si
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x242]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x240], si
call sub.MSVCR90.dll_memset
cmp rbx, rsi
je 0x14001c4f5
mov rcx, rbx
call sub.MSVCR90.dll_wcslen
cmp rax, rsi
jbe 0x14001c4f5
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
je 0x14001c4f5
lea r9, [rsp + 0x30]
lea r8, [0x140105ac0]
lea rcx, [rsp + 0x240]
mov edx, 0x104
mov qword [rsp + 0x20], rbx
call fcn.14001c3d8
cmp eax, esi
jl 0x14001c4f5
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x14001c4f7
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140103060
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rsi
ret
Function at 0x14001c518
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
test rcx, rcx
jne 0x14001c546
lea eax, [rcx + 0x57]
jmp 0x14001c63a
lea rcx, str.wintrust.dll
call fcn.14001c440
mov rdi, rax
test rax, rax
jne 0x14001c56d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rdi + 0x7e]
test eax, eax
cmove eax, ecx
jmp 0x14001c63a
call fcn.14001c308
lea rdx, str.WinVerifyTrust
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rdi
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rdi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTHelperGetProvCertFromChain
mov rcx, rdi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test r15, r15
je 0x14001c61d
test r12, r12
je 0x14001c61d
test r13, r13
je 0x14001c61d
test rax, rax
je 0x14001c61d
test ebp, ebp
jne 0x14001c5f0
lea rdx, str.WintrustLoadFunctionPointers
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x14001c61d
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x30]
call sub.MSVCR90.dll_memset
mov qword [rbx], rdi
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x20], r14
test ebp, ebp
jne 0x14001c619
mov qword [rbx + 0x28], rsi
xor eax, eax
jmp 0x14001c63a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
mov eax, 0x7f
test ebx, ebx
cmove ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002cbd0
Capabilities:
Hash data using sha1

Disassembly:
and dword [rcx + 0x14], 0
and dword [rcx + 0x18], 0
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov eax, 1
ret

Function at 0x14002ddb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x120
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14002df7f
test rdx, rdx
jle 0x14002df7f
test r8, r8
je 0x14002df7f
mov r12d, 0xf0
cmp rdx, r12
ja 0x14002de10
mov eax, 0x22000009
jmp 0x14002df84
lea rcx, [rsp + 0x20]
mov r8, r12
xor edx, edx
call sub.MSVCR90.dll_memset
mov ebp, 1
lea rcx, [rsp + 0x20]
lea edx, [rbp + 0x3f]
mov r9, rbx
mov r8, rbp
call sub.MSVCR90.dll_fread
cmp rax, rbp
je 0x14002de46
mov eax, 0x22000005
jmp 0x14002df84
lea rdx, [0x140108be0]
lea rcx, [rsp + 0x20]
mov r8d, 2
call sub.MSVCR90.dll_memcmp
test eax, eax
jne 0x14002de06
movzx eax, byte [rsp + 0x5e]
movzx ecx, byte [rsp + 0x5f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x5d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x5c]
shl ecx, 8
mov r8d, ecx
or rcx, rax
cmp rdi, rcx
jle 0x14002de06
movzx edx, byte [rsp + 0x5c]
mov rcx, rbx
or edx, r8d
xor r8d, r8d
call sub.MSVCR90.dll_fseek
test eax, eax
js 0x14002de3c
mov edi, 4
lea rcx, [rsp + 0x60]
mov r9, rbx
mov rdx, rdi
mov r8, rbp
call sub.MSVCR90.dll_fread
cmp rax, rbp
jne 0x14002de3c
lea rdx, [0x140108bd8]
lea rcx, [rsp + 0x60]
mov r8, rdi
call sub.MSVCR90.dll_memcmp
test eax, eax
jne 0x14002de06
lea edx, [rdi + 0x10]
lea rcx, [rsp + 0x64]
mov r9, rbx
mov r8, rbp
call sub.MSVCR90.dll_fread
cmp rax, rbp
jne 0x14002de3c
lea edx, [rdi - 2]
lea rcx, [rsp + 0x78]
mov r9, rbx
mov r8, rbp
call sub.MSVCR90.dll_fread
cmp rax, rbp
jne 0x14002de3c
movzx eax, byte [rsp + 0x78]
movzx ecx, byte [rsp + 0x79]
shl cx, 8
or cx, ax
mov eax, 0x20b
cmp cx, ax
jne 0x14002df6a
mov edx, 0x96
lea rcx, [rsp + 0x7a]
mov r8, rbp
mov r9, rbx
call sub.MSVCR90.dll_fread
cmp rax, rbp
jne 0x14002de3c
lea rdx, [rsp + 0x20]
mov r8, r12
mov rcx, rsi
call sub.MSVCR90.dll_memcpy
xor eax, eax
jmp 0x14002df84
mov eax, 0x10b
cmp cx, ax
jne 0x14002de06
mov edx, 0x86
jmp 0x14002df3d
mov eax, 0x22000001
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140103060
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14002eabc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, r8
mov rdi, rcx
test rcx, rcx
je 0x14002eb99
test rdx, rdx
jle 0x14002eb99
test rbx, rbx
je 0x14002eb99
mov esi, 0x3c
cmp rdx, rsi
jae 0x14002eb0f
mov eax, 0x22000009
jmp 0x14002eb9e
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x20]
mov r9, rdi
mov r8d, 1
mov rdx, rsi
call sub.MSVCR90.dll_fread
cmp rax, 1
je 0x14002eb41
mov eax, 0x22000005
jmp 0x14002eb9e
lea rdx, str.MSCF
lea rcx, [rsp + 0x20]
mov r8d, 4
call sub.MSVCR90.dll_memcmp
test eax, eax
jne 0x14002eb05
test byte [rsp + 0x3e], 4
jne 0x14002eb6a
mov eax, 0x2200000e
jmp 0x14002eb9e
movzx eax, byte [rsp + 0x44]
movzx ecx, byte [rsp + 0x45]
shl cx, 8
or cx, ax
mov eax, 0x14
cmp ax, cx
jne 0x14002eb63
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rbx
call sub.MSVCR90.dll_memcpy
xor eax, eax
jmp 0x14002eb9e
mov eax, 0x22000001
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140103060
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret