joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032554
Capabilities:
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xe0
lea rdx, [0x14002fc00]
lea rcx, [rsp + 0x78]
call fcn.140028714
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.14003089c
nop
lea rcx, [rsp + 0x78]
call fcn.14002a1a4
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xc0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xa8], 0
lea rax, [0x14002fd1c]
mov qword [rsp + 0x98], rax
lea rax, [0x14003a958]
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x90], 3
lea rcx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x140032628
lea rdx, str._n_n_github.com_jeremysys
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002886c
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, [0x14003a988]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140041058], rax
mov edx, 5
mov rcx, qword [0x140041058]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x14003a948]
mov rcx, qword [0x140041058]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x140041058]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x140041058]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0xe0
pop rdi
ret
Function at 0x140033330
Capabilities:
Execute command
Terminate process

Disassembly:
sub rsp, 0x38
call fcn.1400309b8
movzx eax, al
test eax, eax
je 0x14003334e
lea rcx, str._nDriver_loaded__n
call fcn.14003343c
jmp 0x14003336d
lea rcx, str._nDriver_not_loaded__n
call fcn.14003343c
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rcx, [0x14003a8b0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._nWaiting_for_Fortnite..._n
call fcn.14003343c
cmp qword [0x140040f60], 0
jne 0x1400333cc
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.FortniteClient_Win64_Shipping.exe
call fcn.140030aa0
mov dword [0x140040f68], eax
mov ecx, dword [0x140040f68]
call fcn.140030b8c
mov qword [0x140040f60], rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140033386
lea rax, str.EasyAntiCheat_EOS.exe
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
call fcn.14002eb94
movzx eax, al
test eax, eax
je 0x1400333f2
mov byte [0x140041050], 1
jmp 0x1400333f9
mov byte [0x140041050], 0
call fcn.14002a5b4
movzx eax, al
call fcn.140030a18
mov qword [0x140040f58], rax
mov rdx, qword [0x140040f58]
lea rcx, str._nbase_address__p_n
call fcn.14003343c
call fcn.140032554
call fcn.1400326fc
call fcn.140032eb0
call fcn.140033218
xor eax, eax
add rsp, 0x38
ret

Function at 0x140034150
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003419a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003419a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003419a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003419a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003419a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003419c
xor al, al
add rsp, 0x28
ret
Function at 0x1400039da
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
mov edi, r8d
and edi, 0x300
lea r8d, [rdi + 9]
lea r9, [rsp + 0x40]
call fcn.1400081b6
test eax, eax
jne 0x140003ab5
test bpl, 2
je 0x140003a49
lea r9, [rsp + 0x4c]
mov dword [r9], 0
mov rcx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x140003aa5
lea r14, [rsp + 0x50]
mov r15, qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov rcx, qword [rsp + 0x40]
xor edx, edx
mov r8, r14
mov r9d, 0x105
call r15
test eax, eax
jne 0x140003a86
test bpl, 1
jne 0x140003aa5
mov rcx, qword [rsp + 0x40]
mov rdx, r14
mov r8d, ebp
call fcn.1400039da
test eax, eax
je 0x140003a55
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
mov rdx, rsi
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
jmp 0x140003ab5
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140003b6d
Capabilities:
Hide graphical window

Disassembly:
push rsi
sub rsp, 0xb0
mov eax, ecx
mov rcx, qword [0x14001aa38]
test eax, eax
je 0x140003ba1
test rcx, rcx
je 0x140003b8d
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x14001aa38], 0
add rsp, 0xb0
pop rsi
ret
test rcx, rcx
je 0x140003bb5
xor ecx, ecx
add rsp, 0xb0
pop rsi
jmp fcn.1400087b6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x14001aa40]
jbe 0x140003b98
mov rax, qword [0x14000b010]
cmp qword [rax], 0
je 0x140003c23
mov rax, qword [0x14000b368]
test byte [rax + 0x34], 1
je 0x140003b98
mov ecx, dword [0x140022a54]
mov r8d, dword [0x14001aa44]
cmp ecx, r8d
cmovae ecx, r8d
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_MulDiv]
lea rdx, str....__d__
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor ecx, ecx
mov rdx, rsi
call fcn.140007138
jmp 0x140003b98
mov rax, qword [0x14000b048]
mov rcx, qword [rax]
mov qword [rsp + 0x20], 0
lea r9, [0x140003ac8]
mov edx, 0x6f
xor r8d, r8d
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [0x14001aa38], rax
mov rcx, rax
mov edx, 5
add rsp, 0xb0
pop rsi
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x140004044
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov ebx, r9d
mov r14, r8
mov rsi, rdx
test ecx, ecx
js 0x14000407c
mov edx, ecx
add edx, dword [0x140022b74]
mov dword [0x140022b10], edx
mov rcx, qword [0x140018028]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, 4
call fcn.14000417b
test eax, eax
js 0x140004101
mov rcx, qword [0x140018028]
lea rdx, [rsp + 0x28]
mov r8d, 4
call fcn.14000800f
test eax, eax
je 0x140004162
add dword [0x140022b10], 4
mov ecx, dword [rsp + 0x28]
call fcn.14000417b
test eax, eax
js 0x140004101
test r14, r14
je 0x140004105
mov rcx, qword [0x140018028]
mov eax, dword [rsp + 0x28]
cmp eax, ebx
cmovl ebx, eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, 0xfffffffd
test eax, eax
je 0x140004167
mov edi, dword [rsp + 0x2c]
add dword [0x140022b10], edi
jmp 0x140004167
mov edi, eax
jmp 0x140004167
mov ebx, dword [rsp + 0x28]
xor edi, edi
test ebx, ebx
jle 0x140004167
mov ebp, 0x4000
lea r14, [0x140022b80]
cmp ebx, ebp
cmovge ebx, ebp
mov rcx, qword [0x140018028]
mov rdx, r14
mov r8d, ebx
call fcn.14000800f
test eax, eax
je 0x140004162
mov rcx, rsi
mov rdx, r14
mov r8d, ebx
call fcn.140008045
test eax, eax
je 0x140004174
add edi, ebx
mov eax, dword [rsp + 0x28]
add dword [0x140022b10], ebx
sub eax, ebx
mov dword [rsp + 0x28], eax
mov ebx, eax
test eax, eax
jg 0x14000411b
jmp 0x140004167
mov edi, 0xfffffffd
mov eax, edi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov edi, 0xfffffffe
jmp 0x140004167

Function at 0x14000436c
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x14000b058]
mov rdi, qword [rax]
lea rsi, [rdi + 0xc800]
mov rcx, rsi
call fcn.140007d82
mov rcx, rsi
call fcn.140007ccc
test eax, eax
je 0x1400043bf
mov rcx, rsi
call fcn.140007c58
mov rcx, rsi
call fcn.140007631
add rdi, 0xc000
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140007f83
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140004a47
Capabilities:
Delete file
Enumerate files on windows
Move file

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [0x14000b510]
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x140004a69
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], 0xffffffffffffffff
mov rsi, qword [0x14000b508]
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x140004a86
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], 0xffffffffffffffff
call fcn.140004ad4
mov rax, qword [0x14000b058]
mov ecx, 0xd000
add rcx, qword [rax]
mov edx, 7
add rsp, 0x20
pop rsi
jmp fcn.140007876
Function at 0x1400075d0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x68
lea rax, [rsp + 0x40]
mov dword [rax], 0x40001
lea rdx, [0x14000b620]
mov qword [rax + 8], rdx
lea r8, [0x14000b610]
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], r8
lea rdx, [rsp + 0x28]
mov dword [rdx], 0x18
mov qword [rdx + 8], rax
mov dword [rdx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x14000762b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
add rsp, 0x68
ret

Function at 0x140007631
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140007648
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400076cd
Capabilities:
Create process on windows

Disassembly:
push rsi
sub rsp, 0x70
mov rdx, rcx
mov dword [0x140033cb0], 0x68
lea rax, [0x140033cb0]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 0
xor esi, esi
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140007731
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
mov rax, rsi
add rsp, 0x70
pop rsi
ret

Function at 0x14000773a
Capabilities:
Create process on windows

Disassembly:
mov dword [rcx], 0x70
mov qword [rcx + 0x40], 0
jmp qword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x1400077f4
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov edi, edx
mov rsi, rcx
call fcn.140007849
cmp eax, 0xffffffff
je 0x14000783f
mov ebx, eax
mov rcx, rsi
test dil, 1
jne 0x14000781d
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140007823
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, eax
mov eax, 1
test ecx, ecx
jne 0x140007841
test dil, 4
jne 0x14000783f
mov rcx, rsi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140007849
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000786d
mov edx, esi
and edx, 0xfffffffe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140007876
Capabilities:
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov ebx, edx
mov rsi, rcx
call fcn.140007ade
test bl, 8
jne 0x1400078c4
mov ebp, eax
mov edi, ebx
and edi, 4
test bl, 1
jne 0x1400078e0
lea rcx, [0x140033d20]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, rsi
call fcn.140007bc2
jmp 0x14000791a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x14000b368]
cmp eax, 1
adc dword [rcx + 8], 0
jmp 0x140007aa0
test bl, 2
je 0x140007a59
test ebp, ebp
je 0x140007a59
lea r14, [0x140033d20]
mov rcx, r14
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rdx, str..
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp word [rsi], 0
jne 0x14000792a
cmp word [0x140033d20], 0x5c
jne 0x14000793a
lea rdx, [0x14000b64e]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea r14, [rsi + rax*2]
lea rcx, [0x140033d20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140007a4d
mov r15, rax
mov dword [rsp + 0x24], ebp
mov ebp, ebx
and ebp, 3
lea r13, [rsp + 0x28]
mov r12, qword [sym.imp.KERNEL32.dll_FindNextFileW]
movzx ecx, word [rsp + 0x54]
movzx eax, word [rsp + 0x56]
cmp cx, 0x2e
jne 0x140007996
test ax, ax
je 0x140007a2f
cmp cx, 0x2e
jne 0x1400079ae
cmp ax, 0x2e
jne 0x1400079ae
cmp word [rsp + 0x58], 0
je 0x140007a2f
mov rcx, r14
lea rdx, [rsp + 0x54]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
test byte [rsp + 0x28], 0x10
jne 0x1400079e6
mov rcx, rsi
mov edx, edi
call fcn.1400077f4
test eax, eax
je 0x1400079f7
mov ecx, 0xfffffff2
mov rdx, rsi
call fcn.140007138
jmp 0x140007a2f
cmp ebp, 3
jne 0x140007a2f
mov rcx, rsi
mov edx, ebx
call fcn.140007876
jmp 0x140007a2f
test edi, edi
jne 0x140007a07
mov rax, qword [0x14000b368]
inc dword [rax + 8]
jmp 0x140007a2f
mov ecx, 0xfffffff1
mov rdx, rsi
call fcn.140007138
mov rcx, rsi
xor edx, edx
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rax, qword [0x14000b368]
inc dword [rax + 0x10]
mov rcx, r15
mov rdx, r13
call r12
test eax, eax
jne 0x14000797d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [rsp + 0x24]
test bl, 1
je 0x140007aa0
mov word [r14 - 2], 0
test ebp, ebp
je 0x140007a96
mov rcx, rsi
call fcn.140007c27
test rax, rax
je 0x140007aa0
mov rcx, rsi
call fcn.140007c58
mov edx, edi
or edx, 1
mov rcx, rsi
call fcn.1400077f4
test eax, eax
je 0x140007a92
mov ecx, 0xffffffe5
mov rdx, rsi
call fcn.140007138
jmp 0x140007aa0
test edi, edi
jne 0x140007ab4
mov rax, qword [0x14000b368]
inc dword [rax + 8]
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0xfffffff1
mov rdx, rsi
call fcn.140007138
mov rcx, rsi
xor edx, edx
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rax, qword [0x14000b368]
inc dword [rax + 0x10]
jmp 0x140007aa0
Function at 0x140007ade
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdx, rcx
lea rbx, [0x140034520]
mov rcx, rbx
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, rbx
call fcn.140007cf8
xor esi, esi
test rax, rax
je 0x140007ba2
mov rdi, rax
mov rcx, rax
call fcn.140007d82
mov rax, qword [0x14000b5f0]
test byte [rax], 0x80
je 0x140007b36
movzx eax, word [rdi]
test eax, eax
je 0x140007ba2
cmp eax, 0x5c
je 0x140007ba2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
sub rdi, rbx
sar rdi, 1
cmp rdi, rax
jge 0x140007b81
lea rbx, [0x140034520]
mov r14, qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbx
call fcn.140007c27
test rax, rax
je 0x140007b6c
test byte [rax], 0x10
je 0x140007ba2
mov rcx, rbx
call fcn.140007bc2
mov rcx, rbx
call r14
cdqe
cmp rdi, rax
jl 0x140007b5a
lea rsi, [0x140034520]
mov rcx, rsi
call fcn.140007c58
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
setne sil
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140007c08
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rax, qword [0x14000b368]
inc dword [rax + 0x10]
add rsp, 0x28
ret

Function at 0x140007f38
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, r8d
mov edi, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x30], 0
mov rcx, rbx
mov edx, edi
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x140007f83
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov ebp, 0xffffff9b
movabs r14, 0x610073006e
mov r15, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rbx, [rsp + 0x28]
mov r12, qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
inc ebp
je 0x140007ff6
mov qword [rsp + 0x28], r14
call r15
mov ecx, eax
imul rcx, rcx, 0x4ec4ec4f
shr rcx, 0x23
lea edx, [rcx + rcx*4]
lea edx, [rdx + rdx*4]
add edx, ecx
sub eax, edx
add word [rsp + 0x2c], ax
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
mov r9, rsi
call r12
test eax, eax
je 0x140007fb9
jmp 0x140007ffd
mov word [rsi], 0
xor esi, esi
mov rax, rsi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14000800f
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov esi, r8d
mov qword [rsp + 0x20], 0
lea rdi, [rsp + 0x34]
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
cmp dword [rdi], esi
sete cl
and cl, al
movzx eax, cl
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x140008045
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov esi, r8d
mov qword [rsp + 0x20], 0
lea rdi, [rsp + 0x34]
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
cmp dword [rdi], esi
sete cl
and cl, al
movzx eax, cl
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14000807b
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, rdx
mov rdi, rcx
xor r14d, r14d
mov esi, 1
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x140008116
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x2e]
lea r9, [rsp + 0x30]
mov rcx, rdi
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400080e5
cmp dword [rsp + 0x30], 2
jne 0x1400080e5
movzx eax, word [rsp + 0x2e]
cmp eax, 0xfeff
jne 0x1400080e5
mov esi, r14d
jmp 0x140008116
test rbx, rbx
je 0x140008105
xor r14d, r14d
mov rcx, rdi
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x140008122
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rdx, [0x14000b652]
lea rsi, [rsp + 0x34]
mov rcx, rdi
mov r8d, 2
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsi], 2
mov ecx, 0x80004005
cmovne r14d, ecx
test eax, eax
cmove r14d, ecx
jmp 0x1400080e0

Function at 0x14000825a
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r9
mov rdi, r8
xor r8d, r8d
cmp dword [rsp + 0x80], 0
mov dword [rsp + 0x3c], 0x800
setne r8b
shl r8d, 9
or r8d, 0x20019
lea r9, [rsp + 0x40]
call fcn.1400081b6
test eax, eax
jne 0x1400082e1
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x38]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [rsi + 0x7fe], 0
test edi, edi
jne 0x1400082e1
mov eax, dword [rsp + 0x38]
add eax, 0xfffffffd
cmp eax, 0xfffffffd
ja 0x1400082e6
mov word [rsi], 0
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140008736
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x260
mov rsi, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, 0x105
cmovb ecx, eax
test ecx, ecx
je 0x14000876f
lea edx, [rcx - 1]
xor eax, eax
cmp word [rsp + rdx*2 + 0x20], 0x5c
sete al
jmp 0x140008774
mov eax, 1
mov ecx, ecx
lea rcx, [rsp + rcx*2]
add rcx, 0x20
lea rdx, [0x14000b64e]
lea r8, [rdx + rax*2]
lea rdx, str._s_S.dll
mov r9, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop
add rsp, 0x260
pop rsi
ret

Function at 0x1400088d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov eax, ecx
cmp dword [0x140035f74], 0
lea rcx, [0x140035f70]
jne 0x14000891a
xor r9d, r9d
mov r10d, 8
mov r11d, r9d
mov esi, r11d
shr esi, 1
and r11d, 1
neg r11d
and r11d, 0xedb88320
xor r11d, esi
dec r10d
jne 0x1400088ef
mov dword [rcx + r9*4], r11d
inc r9
cmp r9, 0x100
jne 0x1400088e6
test r8, r8
je 0x140008940
not eax
xor r9d, r9d
mov r10b, byte [rdx + r9]
xor r10b, al
movzx r10d, r10b
shr eax, 8
xor eax, dword [rcx + r10*4]
inc r9
cmp r8, r9
jne 0x140008924
not eax
pop rsi
ret
Function at 0x1400986e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400986ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400986fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400986e5
lea eax, [rcx + 1]
jmp 0x14009870b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14009871e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140098704
sub eax, 3
jb 0x14009873e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14009878d
sar eax, 1
movsxd rbp, eax
jb 0x140098774
jmp 0x14009874c
add ebx, ebx
jne 0x14009874a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140098774
inc ecx
add ebx, ebx
jne 0x14009875a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140098774
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14009876d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14009875c
add ecx, 2
jmp 0x140098779
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400986a2
jmp 0x1400986ed
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x65400
mov dl, 0x15
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400987dd
cmp rsi, rcx
jae 0x1400987e5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400987c4
cmp al, 0x8f
ja 0x1400987c4
cmp byte [rsi - 2], 0xf
je 0x1400987ca
sub al, 0xe8
cmp al, 1
ja 0x1400987ae
cmp rsi, rcx
jae 0x1400987e5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400987b4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400987e5
lodsb al, byte [rsi]
jmp 0x1400987c4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x95000]
mov eax, dword [rdi]
or eax, eax
je 0x140098842
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x9856c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400987f2
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14009883c
mov qword [rbx], rax
add rbx, 8
jmp 0x140098812
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14009887c
cmp al, 0xef
ja 0x14009886e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14009884e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14009885d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400988d0
sub rsp, 0xffffffffffffff80
jmp 0x14002dc30