joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032360
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x51eb851f
mov edi, r8d
mov r8d, edx
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rcx]
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x1400323b2
lea rdx, str.Couldnt_set_desired_mode
call fcn.140017340
lea eax, [rbx + 0x11]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp r8d, 0xc8
je 0x1400323c7
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.140017290
cmp edi, 0x13
jne 0x1400323d6
mov rcx, rsi
call fcn.1400322e0
jmp 0x140032401
cmp edi, 0x14
jne 0x1400323e5
mov rcx, rsi
call fcn.14002f2d0
jmp 0x140032401
cmp edi, 0x15
jne 0x1400323f4
mov rcx, rsi
call fcn.140032340
jmp 0x140032401
cmp edi, 0x16
jne 0x140032403
mov rcx, rsi
call fcn.140032350
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140032af0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx]
mov ebx, dword [rcx + 0x9ec]
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov rdi, rcx
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x140032b7c
test ebx, ebx
jne 0x140032b3a
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rsi
call fcn.140017290
mov dword [rdi + 0x58c], ebx
inc ebx
cmp ebx, 2
jne 0x140032b63
lea rdx, str.Failed_to_do_PORT
mov rcx, rsi
call fcn.140017340
lea eax, [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14002eae0
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rsi
call fcn.140017290
xor edx, edx
mov rcx, rdi
call fcn.14002e9a0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140032950
Function at 0x140039d80
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x14007cfb8]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.14004ef5c
mov byte [rsp + 0x20], 0
test rax, rax
je 0x140039de6
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x140039de6
lea rcx, [rsp + 0x20]
call qword [case.0x14001863c.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14004cef0
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14004cef0
add rsp, 0x148
ret
jmp 0x140039d80

Function at 0x140039e00
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x14007cfb8]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.14004ef5c
mov byte [rsp + 0x20], 0
test rax, rax
je 0x140039de6
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x140039de6
lea rcx, [rsp + 0x20]
call qword [case.0x14001863c.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14004cef0
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14004cef0
add rsp, 0x148
ret
jmp 0x140039d80

Function at 0x14003db40
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
xor eax, eax
test edx, edx
lea r8, [rsp + 0x38]
setne al
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x140040830
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov byte [rcx], 0
mov edx, ebx
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x140040869
lea edx, [rax + 0x2e]
mov rcx, rdi
call fcn.14004d808
test rax, rax
je 0x140040867
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140040940
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14007cfb8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x48]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140040a11
xor eax, eax
lea rdx, [rsp + 0x64]
mov rcx, rsi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov word [rsp + 0x58], 0x208
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
mov dword [rsp + 0x68], eax
call fcn.1400408a0
lea rcx, [rsp + 0x64]
mov edx, 8
call fcn.140045f00
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
lea r11, [rsp + 0x50]
lea r8d, [r9 + 0x14]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x140040a15
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x140040a62
mov ecx, dword [rsp + 0x40]
mov rax, qword [rdi]
xor r9d, r9d
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rbx], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14004cef0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140040a90
Capabilities:
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov r8, rcx
mov rdx, rdi
mov rcx, rsi
call fcn.140040940
lea r8, [rbx + 7]
lea rdx, [rdi + 8]
mov rcx, rsi
call fcn.140040940
lea r8, [rbx + 0xe]
lea rdx, [rdi + 0x10]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140040940
Function at 0x140040be0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
mov rbx, r8
mov rbp, rdx
not rcx
dec rcx
mov rsi, rcx
add rcx, rcx
call qword [fcn.140049860]
mov rdi, rax
test rax, rax
jne 0x140040c27
lea eax, [rdi + 0x1b]
jmp 0x140040ce3
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.140040bb0
lea rcx, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140040cd0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140040cc3
mov rcx, qword [rsp + 0x30]
lea r8d, [rsi + rsi]
xor r9d, r9d
mov rdx, rdi
mov dword [rsp + 0x68], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rbx
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, rdi
mov dword [rbx + 0x10], eax
mov byte [rbx + 0x14], al
call qword [fcn.14004826c]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140043740
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rdi, r8
cmp dword [rcx + 8], 3
mov rsi, rdx
jne 0x14004378a
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x14004377a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rsi
call rax
jmp 0x1400437d2
cmp qword [rbx + 0x10], 0
jne 0x1400437be
mov rcx, qword [rcx + 0x10]
lea rdx, [0x1400627a8]
call fcn.140047d08
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1400437be
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rbx + 0x10]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call fcn.1400481fc
mov rdi, rax
test rax, rax
jne 0x1400437f5
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400437ec
call fcn.14004741c
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140046a20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov r12d, r8d
lea r9d, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbp, rdx
lea rcx, [r9 + rax + 0x18]
call qword [fcn.140049860]
mov rdi, rax
test rax, rax
jne 0x140046a61
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rsp + 0x48], rsi
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp r12d, dword [rbx + 0x1c]
jbe 0x140046aa5
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, r12d
mov rdx, rbp
call qword [rbx + reloc.WS2_32.dll_htonl]
mov ebp, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rbp, qword [rdi + 0x10]
mov rcx, rbp
call qword [rbx + reloc.WS2_32.dll_recv]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test r12, r12
je 0x140046b04
mov rsi, r12
nop dword [rax + rax]
movzx eax, byte [rbp]
lea rdx, [rsp + 0x40]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx r11d, byte [rbp]
lea rdx, [rsp + 0x40]
xor r11b, 0x5c
mov r8d, 1
inc rbp
mov byte [rsp + 0x40], r11b
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
dec r12
jne 0x140046ac0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140046b43
nop dword [rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400707b9]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400707ba]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140046b10
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret

Function at 0x140049380
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400491f0
Function at 0x14005877b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14007cfb8]
jne 0x14004cf0a
rol rcx, 0x10
test cx, 0xffff
jne 0x14004cf06
repz ret
ror rcx, 0x10
jmp 0x1400586d4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14007f730]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14007f828]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140058759
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14007f730]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14005877b
mov rax, qword [rsp + 0x88]
mov qword [0x14007f828], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14007f7c8], rax
mov rax, qword [0x14007f828]
mov qword [0x14007f6a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14007f7b0], rax
mov dword [0x14007f690], 0xc0000409
mov dword [0x14007f694], 1
mov rax, qword [0x14007cfb8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14007cfc0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14007f728], eax
mov ecx, 1
call fcn.14005b480
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400731f8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14007f728], 0
jne 0x140058802
mov ecx, 1
call fcn.14005b480
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14005bfe8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14007cfb8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140050a94
xor ebx, ebx
cmp qword [0x14007fc90], rbx
mov rdi, rax
jne 0x14005c0fb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14005c1d2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005c1d2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14007fc90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14007fc98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14007fca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14007fcb0], rax
test rax, rax
je 0x14005c0f2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14007fca8], rax
jmp 0x14005c102
mov rax, qword [0x14007fca8]
jmp 0x14005c109
mov rax, qword [0x14007fca8]
mov r11, qword [0x14007fcb0]
cmp rax, rdi
je 0x14005c170
cmp r11, rdi
je 0x14005c170
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14007fcb0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14005c170
test rax, rax
je 0x14005c170
call rsi
test rax, rax
je 0x14005c16a
lea rcx, [rsp + 0x30]
mov r9d, ntohs
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14005c16a
test byte [rsp + 0x40], 1
jne 0x14005c170
bts ebp, 0x15
jmp 0x14005c1b0
mov rcx, qword [0x14007fc98]
cmp rcx, rdi
je 0x14005c1b0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14005c1b0
call rax
mov rbx, rax
test rax, rax
je 0x14005c1b0
mov rcx, qword [0x14007fca0]
cmp rcx, rdi
je 0x14005c1b0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14005c1b0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14007fc90]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14005c1d2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14005c1d4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14004cef0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400604ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x1400604d6
call fcn.14004a9e4
and dword [rax], 0
call fcn.14004a9c4
mov ebx, reloc.WLDAP32.dll_Ordinal_22
mov dword [rax], ebx
call fcn.140050550
mov eax, ebx
jmp 0x140060526
test edx, 0xfffffff9
jne 0x1400604b9
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1400604ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004aa04
call fcn.14004a9c4
mov eax, dword [rax]
jmp 0x140060526
test al, 0x10
jne 0x140060524
test al, 1
je 0x140060524
test bl, 2
je 0x140060524
call fcn.14004a9e4
mov dword [rax], 5
call fcn.14004a9c4
mov dword [rax], reloc.WS2_32.dll_listen
jmp 0x1400604f6
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140001038
Capabilities:
Query or enumerate registry value

Disassembly:
push rsp
fild dword [0x1778ff93f]
add eax, dword [rax]
invalid
Function at 0x140001393
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x1400258e0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r12d, ecx
movzx r13d, dx
lea rcx, [0x1402dad10]
xor r14d, r14d
xor edx, edx
mov rbx, r14
call fcn.140119488
lea ebp, [r14 + 1]
test rax, rax
mov rsi, rax
je 0x1400259f6
nop
nop
test rbx, rbx
jne 0x1400259f6
mov eax, r12d
lea edx, [rbx + 6]
movzx r9d, r13w
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
test rax, rax
mov rdi, rax
jne 0x140025964
mov rbx, r14
jmp 0x1400259d9
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14002597a
mov rbx, r14
jmp 0x1400259d4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
jne 0x140025990
mov rbx, r14
jmp 0x1400259d4
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rbx
and ecx, 0xf
jbe 0x1400259c2
nop
nop
cmp rbx, r11
jae 0x1400259c7
add ecx, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x1400259b0
cmp rbx, r11
jb 0x1400259cc
mov rbx, r14
jmp 0x1400259d4
cmp word [rbx], r14w
cmove rbx, r14
test rbx, rbx
jne 0x140025a17
lea rcx, [0x1402dad10]
mov edx, ebp
call fcn.140119488
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x140025930
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
mov rax, rsi
jmp 0x1400259f8

Function at 0x1400013a7
Capabilities:
Delete file

Disassembly:
jmp 0x140058bd0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rcx
mov dword [rcx + 0x78], 0x67
mov rcx, qword [rcx]
test rcx, rcx
je 0x140058c06
call fcn.1401a5a6c
mov qword [rbx], 0
mov rdi, qword [rbx + 0x38]
test rdi, rdi
je 0x140058c37
mov rcx, qword [rdi]
test rcx, rcx
je 0x140058c1d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rdi
call fcn.1401a46a0
mov qword [rbx + 0x38], 0
lea rcx, [rbx + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
Function at 0x140001406
Capabilities:
Get common file path

Disassembly:
jmp 0x14004bd60
mov rax, rsp
push r12
sub rsp, 0x2a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402cf318]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor r12d, r12d
mov ebx, r12d
mov dword [rsp + 0x38], r12d
xor bpl, bpl
call fcn.14011d930
test eax, eax
jne 0x14004be6a
xor edx, edx
lea r8d, [r12 + 0x30]
lea rcx, [rsp + 0x4c]
call fcn.1401a5ec0
mov dword [rsp + 0x48], 0x20034
lea rcx, [rsp + 0x48]
call fcn.1401540a0
test eax, eax
jne 0x14004be6a
cmp dword [rsp + 0x4c], ebx
jne 0x14004bdee
mov bpl, 1
lea ebx, [rax + 0x20]
jmp 0x14004be6a
mov qword [rsp + 0x80], r12
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rsp + 0x88]
call fcn.1401a5ec0
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x30], r12d
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x80]
call fcn.140125cc0
test eax, eax
jne 0x14004be6a
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14004be6a
mov edi, r12d
test eax, eax
jle 0x14004be6a
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsi]
call fcn.14012aa20
test eax, eax
jne 0x14004be5d
cmp dword [rsp + 0x30], 1
jne 0x14004be5d
or ebx, 0x10
add edi, 1
add rsi, 8
cmp edi, dword [rsp + 0x34]
jl 0x14004be42
lea rcx, [rsp + 0x38]
call fcn.140001280
test al, al
je 0x14004be8f
test bpl, bpl
jne 0x14004be8c
cmp dword [rsp + 0x38], 0x82db
jae 0x14004be8f
or ebx, 4
jmp 0x14004be8f
or ebx, 8
mov eax, dword [0x1402d7144]
test al, 1
jne 0x14004bebb
or eax, 1
mov dword [0x1402d7144], eax
lea rcx, [0x1402d59c0]
call fcn.1400026a3
lea rcx, [0x14024c140]
call fcn.1401a51b4
nop
cmp byte [0x1402d59d8], 0
jne 0x14004bf5f
mov edx, 0x104
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, str.dwmapi.dll
mov qword [rsp + 0x28], r11
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [0x140252768]
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rsp + 0x80]
call fcn.1401a5928
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.1400015d2
mov rdi, rax
test rax, rax
je 0x14004bf5f
lea rdx, str.DwmIsCompositionEnabled
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004bf56
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x30]
call rax
test eax, eax
jne 0x14004bf56
cmp dword [rsp + 0x30], eax
jne 0x14004bf56
or ebx, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
test ebx, ebx
cmove ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401a5800
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x1400014a1
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
jmp 0x1400643f0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
mov edi, edx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x14006451c
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x14006444e
cmp ax, 0x2f
je 0x14006444e
movzx ecx, ax
call fcn.1401a9dac
test eax, eax
je 0x14006451c
cmp word [rbx + 2], 0x3a
jne 0x14006451c
movzx eax, word [rbx + 4]
cmp ax, 0x5c
je 0x14006444e
cmp ax, 0x2f
jne 0x14006451c
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rsi
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
xor esi, esi
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400644d1
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
lea rdx, str.SkipFileSignatureVerification
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x50]
test eax, eax
cmovne ecx, esi
mov dword [rsp + 0x50], ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str._n_This_is_being_ignore_per
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str.define_NV_SKIP_FILE_SIGNATURE_VERIFICATION._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str._Please_make_sure_to_revert_this_define_before_submitting_any_changes__n_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
and edi, 0xffffe0f7
xor edx, edx
mov r8d, edi
mov rcx, rbx
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x1400014dd
Capabilities:
Check os version

Disassembly:
jmp 0x14006cf00
push rbx
sub rsp, 0xd0
mov rax, qword [0x1402cf318]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x94
xor ebx, ebx
call fcn.1401a5ec0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x24], 6
jb 0x14006cf56
cmp dword [rsp + 0x28], 2
mov eax, 1
cmovae ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401a5800
add rsp, 0xd0
pop rbx
ret