joyce8/EMBER2024-capa huggingface dataset:
Function at 0x23198ac70
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x2322174b0], 0
jne 0x23198ad76
mov byte [0x2322174b0], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x23198ad4c
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov ecx, 2
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x23198ad3d
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x232218621]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x23198ad38
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x23198ad07
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x23198ae0b
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x23198ad71
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x23198ad71

Function at 0x2319eae40
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x2319eae88
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x2319eae5a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x2319fd860
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x2319fd888
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x2319fd8d0
cdqe
add rsi, rax
sub rbx, rax
jne 0x2319fd8a0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x2319fd8dc
call rbp
cmp dword [rax], 4
je 0x2319fd8a0
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x231a25820
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edx, edx
lea rcx, [0x232214ca0]
movabs rdi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
call sym.pthread_mutex_init
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x232214cb8], 0
movups xmmword [0x232214ca8], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x231a258d5
jmp 0x231a2597f
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x231a25930
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x231a258c0
cmp qword [rbx + 7], r12
jne 0x231a258c0
cmp byte [rbx + 0xf], 0x2e
jne 0x231a258c0
add rbx, 0x10
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x231a2591b
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x231a25925
cmp byte [rbx + rsi], 0x3d
je 0x231a259b5
add rbp, 0x18
cmp rbp, r13
jne 0x231a258ff
jmp 0x231a258c0
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x232214cb8], rbx
jne 0x231a2598f
lea rcx, [sym.__tcf_0]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp dbg.atexit
mov qword [0x232214cb8], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x232214cb0], rax
test rax, rax
je 0x231a259ec
xor edx, edx
mov qword [0x232214ca8], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x231a25967
lea rdx, [rsp + 0x28]
lea rcx, [rbx + rsi + 1]
xor r8d, r8d
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x231a259dc
test dl, dl
jne 0x231a258c0
test eax, eax
js 0x231a258c0
mov dword [rbp + 0x10], eax
jmp 0x231a258c0
xor ecx, ecx
mov qword [0x232214cb8], rcx
jmp 0x231a25967
Function at 0x140001670
Capabilities:
Check if file exists
Get common file path
Get disk information
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov qword [rsp + 0x270], 0xfffffffffffffffe
mov rax, qword [0x1402aa808]
xor rax, rsp
mov qword [rsp + 0x288], rax
lea rcx, [rsp + 0x38]
call fcn.140001cf0
nop
lea rcx, [rsp + 0x28]
call fcn.140001cf0
nop
mov dword [rsp + 0x30], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x30], eax
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140001da0
mov rdx, rax
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edx, 0xffffffff
lea rcx, [rsp + 0x38]
call fcn.140001de0
mov dword [rsp + 0x24], 0
xor r8d, r8d
mov dx, 0x5c
lea rcx, [rsp + 0x38]
call fcn.1400018d0
mov dword [rsp + 0x24], eax
mov r8d, dword [rsp + 0x24]
lea rdx, [rsp + 0x268]
lea rcx, [rsp + 0x38]
call fcn.140001970
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x280], rax
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0x28]
call fcn.140001d70
nop
lea rcx, [rsp + 0x268]
call fcn.140001d50
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.140001da0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 5
jne 0x1400017dc
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400017dc
mov dword [rsp + 0x260], 0
mov rcx, qword [rsp + 0x2a0]
call fcn.140001590
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400017d2
mov dword [rsp + 0x260], 1
cmp dword [rsp + 0x260], 0
je 0x1400017aa
lea rcx, [rsp + 0x28]
call fcn.140001d50
nop
lea rcx, [rsp + 0x38]
call fcn.140001d50
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.1401ab2d0
add rsp, 0x298
ret
Function at 0x140004b60
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x168
mov rax, qword [0x1402aa808]
xor rax, rsp
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x178], 0
je 0x140004b9d
cmp qword [rsp + 0x180], 0
jne 0x140004baf
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140004c61
xor eax, eax
mov rcx, qword [rsp + 0x178]
mov word [rcx], ax
xor eax, eax
mov rcx, qword [rsp + 0x180]
mov word [rcx], ax
mov r8d, 0x11c
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1401ac6a0
mov dword [rsp + 0x30], 0x11c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x150], eax
cmp dword [rsp + 0x150], 0
je 0x140004c0c
cmp dword [rsp + 0x34], 5
jbe 0x140004c0c
xor eax, eax
jmp 0x140004c61
cmp dword [rsp + 0x150], 0
je 0x140004c58
cmp dword [rsp + 0x34], 5
jne 0x140004c58
mov eax, dword [rsp + 0x170]
cmp dword [rsp + 0x38], eax
jne 0x140004c52
mov rax, qword [rsp + 0x178]
movzx ecx, word [rsp + 0x144]
mov word [rax], cx
mov rax, qword [rsp + 0x180]
movzx ecx, word [rsp + 0x146]
mov word [rax], cx
jmp 0x140004c56
xor eax, eax
jmp 0x140004c61
jmp 0x140004c5c
xor eax, eax
jmp 0x140004c61
mov eax, 1
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1401ab2d0
add rsp, 0x168
ret
Function at 0x140005180
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1402aa808]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x74], 0
mov qword [rsp + 0x88], 0
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1401ac6a0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xc0]
call fcn.1401ab004
lea r8, [0x1401df48c]
mov edx, 4
lea rcx, [rsp + 0x60]
call fcn.1401ac918
mov qword [rsp + 0x68], 0
lea rcx, [0x1401df490]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
je 0x14000531d
lea rdx, str.GetDiskFreeSpaceExW
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x1400052c6
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
call qword [rsp + 0x68]
test eax, eax
je 0x1400052aa
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x70], rax
jmp 0x1400052c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.MyGetDiskFreeSpace_GetDiskFreeSpaceEx_failed.__0x_1_lx___n
mov ecx, 2
call fcn.14001c160
jmp 0x14000530f
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x94]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x14000530f
mov eax, dword [rsp + 0x78]
imul eax, dword [rsp + 0x90]
imul eax, dword [rsp + 0x94]
mov dword [rsp + 0x70], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401ab2d0
add rsp, 0xb8
ret
Function at 0x140005340
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov qword [rsp + 0x88], 0xfffffffffffffffe
lea rcx, [rsp + 0x30]
call fcn.140074884
nop
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x20]
call fcn.140018590
nop
mov dword [rsp + 0x28], 1
mov dx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.140010180
lea rdx, str..
lea rcx, [rsp + 0x20]
call fcn.14000fd10
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140001da0
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14007498c
test eax, eax
je 0x140005535
cmp dword [rsp + 0x28], 0
je 0x1400054f8
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x68]
call fcn.140018590
nop
lea rcx, [rsp + 0x30]
call fcn.14007438c
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x30]
call fcn.140074830
test eax, eax
je 0x140005407
lea rcx, [rsp + 0x68]
call fcn.140001d50
jmp 0x1400053c1
mov dx, 0x5c
lea rcx, [rsp + 0x68]
call fcn.140010180
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140074f54
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x98], rax
mov r8, qword [rsp + 0x98]
lea rdx, [0x1401df4ac]
lea rcx, [rsp + 0x78]
call fcn.140010300
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x68]
call fcn.14000fce0
nop
lea rcx, [rsp + 0x78]
call fcn.140001d50
nop
lea rcx, [rsp + 0x70]
call fcn.140001d50
lea rcx, [rsp + 0x30]
call fcn.14000fc60
test eax, eax
je 0x1400054b9
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140001da0
mov rcx, rax
call fcn.140005340
jmp 0x1400054e9
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140001da0
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140001da0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rsp + 0x68]
call fcn.140001d50
jmp 0x1400053c1
lea rcx, [rsp + 0x30]
call fcn.1400742b8
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [rsp + 0x80], eax
lea rcx, [rsp + 0x20]
call fcn.140001d50
nop
lea rcx, [rsp + 0x30]
call fcn.1400748e4
mov eax, dword [rsp + 0x80]
jmp 0x14000555c
mov dword [rsp + 0x84], 0
lea rcx, [rsp + 0x20]
call fcn.140001d50
nop
lea rcx, [rsp + 0x30]
call fcn.1400748e4
mov eax, dword [rsp + 0x84]
add rsp, 0xb8
ret
Function at 0x140005670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400056a4
mov eax, 0xfffffffe
jmp 0x14000589c
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400056c1
mov eax, 2
jmp 0x14000589c
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call fcn.14001d090
test eax, eax
je 0x14000574d
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x54]
mov rcx, qword [rsp + 0x88]
call fcn.14001d090
test eax, eax
je 0x14000574d
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x40], eax
jbe 0x14000570d
mov eax, 1
jmp 0x14000589c
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x40], eax
jae 0x140005723
mov eax, 0xffffffff
jmp 0x14000589c
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x44], eax
jbe 0x140005739
mov eax, 1
jmp 0x14000589c
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x44], eax
jae 0x14000574d
mov eax, 0xffffffff
jmp 0x14000589c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x1400057bb
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0
xor eax, eax
jmp 0x14000589c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x14000583a
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0
xor eax, eax
jmp 0x14000589c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0
mov eax, dword [rsp + 0x5c]
cmp dword [rsp + 0x64], eax
jbe 0x140005861
mov eax, 1
jmp 0x14000589c
mov eax, dword [rsp + 0x5c]
cmp dword [rsp + 0x64], eax
jae 0x140005874
mov eax, 0xffffffff
jmp 0x14000589c
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x60], eax
jbe 0x140005887
mov eax, 1
jmp 0x14000589c
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x60], eax
jae 0x14000589a
mov eax, 0xffffffff
jmp 0x14000589c
xor eax, eax
add rsp, 0x78
ret
Function at 0x1400058b0
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1402aa808]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400058f8
xor eax, eax
jmp 0x1400059b3
mov dword [rsp + 0x48], 1
lea r8, [rsp + 0x4c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x54], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x54], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x38], 0
jne 0x140005999
jmp 0x1400059a0
mov eax, 1
jmp 0x1400059b3
lea rdx, str.RestartWindows_ExitWindowsEx_failed._n
mov ecx, 2
call fcn.14001c160
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401ab2d0
add rsp, 0x68
ret

Function at 0x140005c60
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0x18
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add rsp, 0x48
ret
Function at 0x14000e4a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov rax, qword [0x1402aa808]
xor rax, rsp
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x50]
call fcn.140061270
nop
lea rcx, [rsp + 0x28]
call fcn.140003370
nop
mov dword [rsp + 0x80], 1
cmp qword [rsp + 0xc0], 0
je 0x14000e513
cmp qword [rsp + 0xc0], 0
je 0x14000e53f
mov rcx, qword [rsp + 0xc0]
call fcn.1401abfb8
test rax, rax
jne 0x14000e53f
mov dword [rsp + 0x90], 0
lea rcx, [rsp + 0x28]
call fcn.140003430
nop
lea rcx, [rsp + 0x50]
call fcn.1400612b0
mov eax, dword [rsp + 0x90]
jmp 0x14000e641
mov r8w, 0x5c
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.1400612e0
mov qword [rsp + 0x88], 0
jmp 0x14000e577
mov rax, qword [rsp + 0x88]
inc rax
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x50]
call fcn.140062550
cmp qword [rsp + 0x88], rax
jae 0x14000e617
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x50]
call fcn.1400627c0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140010580
mov dx, 0x5c
lea rcx, [rsp + 0x28]
call fcn.1400105b0
lea rcx, [rsp + 0x28]
call fcn.140003530
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000e5ee
lea rcx, [rsp + 0x28]
call fcn.140003530
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x10
test eax, eax
jne 0x14000e612
lea rcx, [rsp + 0x28]
call fcn.140003530
mov rcx, rax
call fcn.140005c60
mov ecx, dword [rsp + 0x80]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x80], eax
jmp 0x14000e564
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x94], eax
lea rcx, [rsp + 0x28]
call fcn.140003430
nop
lea rcx, [rsp + 0x50]
call fcn.1400612b0
mov eax, dword [rsp + 0x94]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401ab2d0
add rsp, 0xb8
ret
Function at 0x14000ecb0
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov rax, qword [0x1402aa808]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0xd8], 0
cmp qword [rsp + 0x110], 0
jne 0x14000ed3b
lea rdx, [0x1401e99b0]
mov ecx, 5
call fcn.14001c160
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xffffffff
jmp 0x14000ef25
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
shl rax, 1
mov r8d, 0xb2c
lea rdx, [0x1401e1728]
mov rcx, rax
call fcn.140047520
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14000ed8d
lea rdx, str.HELPER_AbbreviationInControl_pszMsg_is_invalid_string._n
mov ecx, 5
call fcn.14001c160
mov eax, 0xffffffff
jmp 0x14000ef25
xor r9d, r9d
xor r8d, r8d
mov edx, 0x31
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
mov edx, 0x5c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.GDI32.dll_GetObjectW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [rsp + 0x38], rax
mov edx, dword [rsp + 0x108]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0xd8], rax
mov r8d, 0x10
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.1401ac6a0
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0xc8]
sub ecx, eax
mov eax, ecx
cdq
mov ecx, 0xa
idiv ecx
mov ecx, dword [rsp + 0xc8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0xc8], eax
mov dword [rsp + 0x20], 0x14120
lea r9, [rsp + 0xc0]
mov r8d, 0xffffffff
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_DrawTextW]
mov edx, 1
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SelectObject]
cmp qword [rsp + 0x38], 0
je 0x14000ef0d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x48]
call fcn.140047560
mov qword [rsp + 0x48], 0
mov eax, 1
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1401ab2d0
add rsp, 0xf8
ret
Function at 0x14001cf50
Capabilities:
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14001cfa5
mov eax, dword [rsp + 0x44]
jmp 0x14001d079
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1401ebd60]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d00e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x28], 0x10
lea rax, [0x1401ebd70]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Wrapper
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x40], eax
jmp 0x14001d016
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x28], 0x16
lea rax, str.grpconv__o
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.GrpConv
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001d051
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x60], 0
je 0x14001d075
mov edx, 1
lea rcx, str.runonce__r
call qword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret