joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005dac0
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, ecx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140002eb0
mov qword [rbp - 0x38], rax
xor r15d, r15d
test rax, rax
je 0x14005db17
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rcx, rax
call fcn.14005d2c0
mov rbx, rax
jmp 0x14005db1a
mov rbx, r15
mov byte [rbx], 1
mov rax, qword [rbx + 8]
mov dword [rax], edi
mov dword [rbp - 0x30], r15d
mov qword [rbp - 0x28], r15
lea rdx, [rbp - 0x30]
mov ecx, edi
call fcn.14005d7b0
test al, al
je 0x14005dcc0
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x30]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x14005dbb2
mov edx, 0xe0
cmp dword [rbp - 0x20], edx
jne 0x14005dcb2
mov rcx, qword [rbx + 8]
call fcn.140002ef0
mov byte [rbx + 1], 1
mov rax, qword [rbp - 0x18]
mov qword [rbx + 8], rax
mov rax, qword [rbp - 0x18]
cmp dword [rax], edi
jne 0x14005dcb2
mov word [rax + 0x32], r15w
mov rax, qword [rbx + 8]
mov word [rax + 0xbe], r15w
mov byte [rbx], r15b
jmp 0x14005dcb2
call fcn.14005e1e0
test al, al
je 0x14005dcb2
mov rsi, qword [rbp - 0x28]
mov r14d, r15d
mov eax, dword [rbp - 0x30]
shr eax, 2
cmp eax, 1
je 0x14005dbf1
mov edx, r14d
mov ecx, dword [rsi]
call fcn.14005d2b0
mov dword [rsi], eax
lea rsi, [rsi + 4]
inc r14d
mov eax, dword [rbp - 0x30]
shr eax, 2
dec eax
cmp r14d, eax
jb 0x14005dbd1
mov rsi, qword [rbp - 0x28]
cmp dword [rsi + 0xc0], edi
jne 0x14005dcb2
mov byte [rbx], r15b
mov rax, qword [rbx + 8]
mov dword [rax], edi
mov dword [rbp - 0x40], r15d
lea rdx, [rsi + 2]
lea rcx, [rbp - 0x38]
call fcn.140002f00
nop
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x38]
mov ecx, dword [rsi + 0xc0]
call fcn.14005d8d0
mov rdi, rax
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14005dc53
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rdi, rdi
je 0x14005dcb2
mov rcx, qword [rbx + 8]
mov al, byte [rsi]
mov byte [rcx + 0xdd], al
mov rcx, qword [rbx + 8]
mov eax, dword [rbp - 0x40]
mov dword [rcx + 0xc4], eax
lea r8, [rsi + 0x52]
lea rdx, [rsi + 0x82]
mov byte [rsp + 0x30], r15b
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x28], eax
mov eax, dword [rdi]
mov dword [rsp + 0x20], eax
lea r9, [rsi + 2]
mov rcx, rbx
call fcn.14005d480
mov edx, 0xffff
mov r9d, edx
mov r8d, edx
mov byte [rsp + 0x20], r15b
mov rcx, rbx
call fcn.14005dcf0
mov edx, 1
mov rcx, qword [rbp - 0x28]
call fcn.140002ef0
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140001020
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14005def0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
and dword [rcx], 0
and qword [rcx + 8], 0
lea rcx, [rsp + 0x38]
call fcn.14005e170
nop
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20219
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete dil
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005df6a
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x14005dfec
and dword [rsp + 0x38], 0
mov qword [rsp + 0x28], rbx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005dfde
cmp dword [rsp + 0x38], 3
jne 0x14005dfde
mov ecx, dword [rbx]
call fcn.140026f10
mov qword [rbx + 8], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005dfd4
cmp dword [rsp + 0x38], 3
je 0x14005dfe1
and dword [rbx], 0
and qword [rbx + 8], 0
jmp 0x14005dfe1
and dword [rbx], 0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbx + 8], 0
setne al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001020
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14005e0b0
Capabilities:
Encrypt data using dpapi

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.14005de40
lea rcx, [rsp + 0x40]
mov rbx, rax
mov byte [rax], 1
and dword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
call fcn.14005def0
test al, al
je 0x14005e155
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 1
xor r8d, r8d
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x14005e146
mov edx, 0x144
cmp dword [rsp + 0x50], edx
jne 0x14005e146
mov rcx, qword [rbx + 8]
call fcn.140002ef0
mov byte [rbx + 1], 1
mov rax, qword [rsp + 0x58]
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x27
jne 0x14005e146
mov byte [rbx], 0
mov rcx, qword [rsp + 0x48]
mov edx, 1
call fcn.140002ef0
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001020
add rsp, 0x70
pop rbx
ret
Function at 0x14005e320
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
mov esi, 0x10000
test rax, rax
je 0x14005e357
sub rbx, rax
add rbx, rsi
cmp rbx, rdi
jae 0x14005e3e1
cmp rbx, qword [0x140093608]
jb 0x14005e37b
cmp rbx, qword [0x140093610]
ja 0x14005e37b
add rbx, 0x8000000
jmp 0x14005e357
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x14005e3e1
mov rcx, qword [rsp + 0x38]
cmp dword [rsp + 0x40], esi
jne 0x14005e402
cmp rcx, rsi
jb 0x14005e402
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_VirtualAlloc
test rax, rax
jne 0x14005e3e3
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x14005e354
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001020
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x14005e357
mov rax, rsi
sub rax, rcx
add rbx, rax
jmp 0x14005e357

Function at 0x14005e604
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbp, rdx
mov rsi, rcx
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x140093728], eax
je 0x14005e63c
mov eax, 0x10dd
jmp 0x14005e74c
mov eax, dword [0x14009372c]
test eax, eax
jne 0x14005e74c
test rbp, rbp
jne 0x14005e657
lea eax, [rbp + 0x57]
jmp 0x14005e74c
test rsi, rsi
jne 0x14005e664
lea eax, [rsi + 6]
jmp 0x14005e74c
cmp qword [rsi], 0
jne 0x14005e67a
mov eax, 6
mov dword [0x14009372c], eax
jmp 0x14005e745
mov ecx, 0x30
call fcn.140002eb0
mov rdi, rax
test rax, rax
jne 0x14005e694
lea ebx, [rax + 8]
jmp 0x14005e72b
mov rcx, qword [rsi]
xor edx, edx
call fcn.140019110
xor edx, edx
mov rcx, rbp
mov rbx, rax
call fcn.140019110
movzx edx, byte [rbx + 0x3e]
mov rbp, qword [rbx + 0x48]
sub rbp, rdx
test dl, dl
je 0x14005e71d
cmp rdx, 0x1e
ja 0x14005e71d
cmp qword [rbx + 0x50], rax
jne 0x14005e71d
lfence
and dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov r8d, 0x40
mov rcx, rbp
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x14005e6ee
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
jmp 0x14005e72b
mov dword [rdi + 8], 1
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x18], rbp
mov eax, dword [rsp + 0x24]
mov dword [rdi + 0x28], eax
mov rax, qword [0x140093740]
mov qword [rdi], rax
xor eax, eax
mov qword [0x140093740], rdi
jmp 0x14005e74c
cmp dword [0x140094b90], 0
mov ebx, 9
jne 0x14005e736
mov dword [0x14009372c], ebx
test rdi, rdi
je 0x14005e743
mov edx, 0x30
mov rcx, rdi
call fcn.140002ef0
mov eax, ebx
mov qword [0x140093730], rsi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001020
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005e770
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x28], rax
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x140093728], eax
je 0x14005e7a5
mov eax, 0x10dd
jmp 0x14005e866
mov rdi, qword [0x140093740]
test rdi, rdi
je 0x14005e81b
mov rax, qword [rdi + 0x20]
lea r9, [rsp + 0x20]
mov r8d, dword [rdi + 0x28]
mov rcx, qword [rdi + 0x18]
movzx edx, byte [rax + 0x3e]
call sub.KERNEL32.dll_VirtualProtect
cmp dword [rdi + 8], 0
jne 0x14005e803
mov rsi, qword [rdi + 0x20]
test rsi, rsi
je 0x14005e803
xor edx, edx
mov rbx, rsi
mov rcx, rsi
and rbx, 0xffffffffffff0000
lea r8d, [rdx + 0x60]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbx + 0x10]
mov qword [rsi + 0x48], rax
mov qword [rbx + 0x10], rsi
and qword [rdi + 0x20], 0
mov rbx, qword [rdi]
mov edx, 0x30
mov rcx, rdi
call fcn.140002ef0
mov rdi, rbx
test rbx, rbx
jne 0x14005e7b1
and qword [0x140093740], 0
call fcn.140017350
mov rdi, qword [0x140093738]
test rdi, rdi
je 0x14005e855
mov rcx, qword [rdi + 8]
call sub.KERNEL32.dll_ResumeThread
mov rbx, qword [rdi]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rdi
call fcn.140002ef0
mov rdi, rbx
test rbx, rbx
jne 0x14005e834
and qword [0x140093738], 0
and dword [0x140093728], 0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001020
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14005e884
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [0x14009372c]
mov rdi, rcx
test eax, eax
jne 0x14005e906
call sub.KERNEL32.dll_GetCurrentThread
cmp rdi, rax
je 0x14005e904
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140002eb0
mov rbx, rax
test rax, rax
jne 0x14005e8bc
lea edi, [rax + 8]
jmp 0x14005e8dd
mov rcx, rdi
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x14005e8ef
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rbx
call fcn.140002ef0
and qword [0x140093730], 0
mov eax, edi
mov dword [0x14009372c], edi
jmp 0x14005e906
mov rax, qword [0x140093738]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov qword [0x140093738], rbx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14005f380
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14005f3b0
mov eax, 0x80070057
jmp 0x14005f41d
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14005f3c4
mov eax, 0x80070002
jmp 0x14005f41d
mov ecx, DispGetParam
call sub.gdiplus.dll_GdipAlloc
mov rbx, rax
test rax, rax
je 0x14005f418
and qword [rax + 8], 0
lea rdx, [rsp + 0x20]
and qword [rax + 0x10], 0
mov rcx, rdi
and qword [rsp + 0x20], 0
lea rax, [0x14006faa0]
mov qword [rbx], rax
call sub.gdiplus.dll_GdipCreateBitmapFromFile
mov dword [rbx + 0x10], eax
mov rcx, rsi
mov rax, qword [rsp + 0x20]
mov qword [rbx + 8], rax
call fcn.14002e820
xor eax, eax
mov qword [rsi], rbx
jmp 0x14005f41d
mov eax, 0x80004005
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001020
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140060040
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
and dword [rbp - 0xd], 0
lea rcx, [rbp - 0x19]
and qword [rbp - 0x19], 0
mov ebx, r8d
and dword [rbp - 0x11], 0
lea r8, str.SoftwareMicrosoftVisualStudio17.0General
and qword [rbp - 9], 0
mov esi, edx
mov rdx, 0xffffffff80000001
mov r9d, 0x20019
call fcn.140011100
test eax, eax
jne 0x1400600fb
mov r8d, esi
lea rdx, str.ImageScaling_d
lea rcx, [rbp + 0xf]
call fcn.14005f6c0
mov rcx, qword [rbp - 0x19]
lea rax, [rbp + 3]
and dword [rbp - 1], 0
lea r9, [rbp + 7]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0xf]
lea rax, [rbp - 1]
mov dword [rbp + 3], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400600fb
cmp dword [rbp + 7], 4
jne 0x1400600fb
mov r8d, dword [rbp - 1]
lea edx, [r8 - 1]
cmp edx, 6
cmovbe ebx, r8d
cmp qword [rbp - 0x19], 0
je 0x14006010c
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140001020
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14006092c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400609a4
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400609a4
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400609a4
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140060998
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400609b6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140060986
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400609a6

Function at 0x140060dd0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a8
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, qword [rsp + 0x320]
lea rax, [0x140068678]
movsxd r13, dword [rsp + 0x318]
mov r14, r8
mov r15, qword [rsp + 0x310]
lea r8, [0x14006d1f8]
mov qword [rsp + 0x38], r9
mov r12, rcx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edi, edi
mov qword [rsp + 0x20], rax
mov rdx, r13
mov rcx, rsi
mov ebx, edi
call fcn.14000c300
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140060f10
test byte [rsp + 0x40], 0x10
je 0x140060ee2
cmp word [rsp + 0x6c], 0x2e
movzx eax, word [rsp + 0x6e]
jne 0x140060e8c
test ax, ax
je 0x140060ee2
cmp word [rsp + 0x6c], 0x2e
jne 0x140060e8c
cmp ax, 0x2e
jne 0x140060e8c
cmp word [rsp + 0x70], di
je 0x140060ee2
lea rcx, [rsp + 0x6c]
call sub.api_ms_win_crt_convert_l1_1_0.dll__wtol
mov edi, eax
test eax, eax
je 0x140060ee0
mov rax, qword [rsp + 0x30]
lea r8, [0x1400693a0]
mov qword [rsp + 0x28], rax
mov r9, r12
mov rdx, r13
mov dword [rsp + 0x20], edi
mov rcx, rsi
call fcn.14000c300
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140060ee0
test r14, r14
je 0x140060ef9
mov rcx, qword [rsp + 0x38]
mov edx, edi
call r14
test eax, eax
jne 0x140060ef9
xor edi, edi
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140060f03
jmp 0x140060e5e
mov dword [r15], edi
mov ebx, 1
xor edi, edi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jne 0x140060f13
mov word [rsi], di
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140001020
add rsp, 0x2a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140061b70
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r13, qword [rsp + 0xb0]
xor ebx, ebx
mov word [r9], bx
mov r14, rdx
mov r12, r9
mov dword [rsp + 0x28], ebx
mov r15, r8
mov qword [rsp + 0x20], rbx
mov word [r13], bx
mov rbp, rcx
mov word [r8], bx
mov edi, 1
mov word [rdx], bx
lea rdx, [rsp + 0x28]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
je 0x140061c4f
mov ecx, esi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbx, rax
test rax, rax
jne 0x140061beb
mov eax, 0x8007000e
jmp 0x140061c51
mov r9, rbx
mov r8d, esi
xor edx, edx
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140061c46
lea r9, [rsp + 0x2c]
mov rcx, rbx
lea r8, [rsp + 0x20]
lea rdx, [0x14006d440]
call sub.VERSION.dll_VerQueryValueW
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140061c46
movzx eax, word [rcx + 0xa]
xor edi, edi
mov word [r14], ax
movzx eax, word [rcx + 8]
mov word [r15], ax
movzx eax, word [rcx + 0xe]
mov word [r12], ax
movzx eax, word [rcx + 0xc]
mov word [r13], ax
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140001020
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140061c70
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x38
test rcx, rcx
jne 0x140061c80
mov eax, 0x80004003
jmp 0x140061c93
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add rsp, 0x38
ret
Function at 0x140062bb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, r8
mov r14, rdx
mov rbp, rcx
xor r15d, r15d
mov edi, r15d
call fcn.140002950
mov rcx, rax
test rax, rax
je 0x140062d01
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], 0x208
lea ecx, [r15 + 1]
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, 0x104
sub eax, edx
or eax, ecx
jge 0x140062c2d
lfence
lea rcx, [rsp + 0x30]
call fcn.140002d40
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsnlen
test eax, eax
js 0x140062ced
cmp eax, dword [rbx - 0xc]
jg 0x140062ced
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
test ebp, ebp
jne 0x140062ca3
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140008e40
mov rbx, qword [rsp + 0x30]
mov edx, dword [rbx - 0x10]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test rax, rax
je 0x140062ce4
mov qword [rsi], rax
lea edi, [rbp + 1]
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140062cc1
lfence
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001020
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400326f0
nop
jmp 0x140062cec
nop
mov ecx, 0x80070057
call fcn.1400327c0
nop
jmp 0x140062d00
nop
mov ecx, 0x80004005
call fcn.1400327c0
int3

Function at 0x1400fe000
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
and rsp, 0xfffffffffffffff0
movabs rcx, 0x1400fe062
movabs rax, sym.imp.KERNEL32.dll_LoadLibraryA
call qword [rax]
movabs rdx, 0x1400fe06b
mov rcx, rax
movabs rax, sym.imp.KERNEL32.dll_GetProcAddress
call qword [rax]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov r9, rcx
movabs r8, 0x1400fe078
mov rdx, rcx
call rax
leave
jmp fcn.14002ca90
Function at 0x140111fe0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140111fed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140111ffd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140111fe5
lea eax, [rcx + 1]
jmp 0x14011200b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14011201e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140112004
sub eax, 3
jb 0x14011203e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14011208d
sar eax, 1
movsxd rbp, eax
jb 0x140112074
jmp 0x14011204c
add ebx, ebx
jne 0x14011204a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140112074
inc ecx
add ebx, ebx
jne 0x14011205a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140112074
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14011206d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14011205c
add ecx, 2
jmp 0x140112079
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140111fa2
jmp 0x140111fed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xa8200
mov dl, 0x22
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401120d9
cmp rsi, rcx
jae 0x1401120e1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401120c0
cmp al, 0x8f
ja 0x1401120c0
cmp byte [rsi - 2], 0xf
je 0x1401120c6
sub al, 0xe8
cmp al, 1
ja 0x1401120aa
cmp rsi, rcx
jae 0x1401120e1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401120b0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401120e1
lodsb al, byte [rsi]
jmp 0x1401120c0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x10d000]
mov eax, dword [rdi]
or eax, eax
je 0x14011214a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x118590]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401120ee
jns 0x140112123
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14011212d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140112144
mov qword [rbx], rax
add rbx, 8
jmp 0x14011210e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140112184
cmp al, 0xef
ja 0x140112176
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140112156
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140112165
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x23f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401121d8
sub rsp, 0xffffffffffffff80
jmp 0x14002fa1c