joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003c864
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
cmp dword [0x18006ef98], 0
je 0x18003ca0a
cmp dword [0x18006ef94], 1
jne 0x18003c89f
cmp qword [0x180073350], 0
jne 0x18003c8ba
cmp dword [0x18006ef94], 2
jne 0x18003ca0a
cmp qword [0x180073358], 0
je 0x18003ca0a
cmp qword [rsp + 0xa0], 0
je 0x18003c8d4
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x70], rax
jmp 0x18003c8df
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
cmp dword [0x18006ef94], 1
jne 0x18003c966
mov rax, qword [0x180073350]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 1
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x68]
call qword [rsp + 0x80]
mov dword [rsp + 0x60], eax
jmp 0x18003c9e1
mov rax, qword [0x180073358]
mov qword [0x18006ef88], rax
mov eax, dword [0x180073360]
mov dword [0x18006ef90], eax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 1
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x68]
call fcn.18003feb2
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jne 0x18003ca0a
mov eax, dword [rsp + 0xc8]
and eax, 4
test eax, eax
jne 0x18003ca00
mov rcx, qword [rsp + 0x68]
call fcn.18003d298
mov rax, qword [rsp + 0x68]
jmp 0x18003caa0
cmp qword [rsp + 0xa0], 0
jne 0x18003ca55
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x18003caa0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
add rsp, 0x98
ret
Function at 0x18003d298
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp dword [0x18006ef98], 0
je 0x18003d337
cmp dword [0x18006ef94], 1
jne 0x18003d2c1
cmp qword [0x180073338], 0
jne 0x18003d2d4
cmp dword [0x18006ef94], 2
jne 0x18003d337
cmp qword [0x180073340], 0
je 0x18003d337
cmp dword [0x18006ef94], 1
jne 0x18003d2fd
mov rax, qword [0x180073338]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x28]
mov dword [rsp + 0x20], eax
jmp 0x18003d32a
mov rax, qword [0x180073340]
mov qword [0x18006ef88], rax
mov eax, dword [0x180073348]
mov dword [0x18006ef90], eax
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x40]
call fcn.18003fe9f
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x18003d337
mov eax, dword [rsp + 0x24]
jmp 0x18003d342
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
add rsp, 0x38
ret

Function at 0x18003df80
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x58
mov ecx, 0x37
call fcn.18003a714
movzx eax, ax
mov dword [rsp + 0x44], eax
mov ecx, 0x27
call fcn.18003a714
movzx eax, ax
mov dword [rsp + 0x40], eax
mov edx, 1
xor ecx, ecx
call fcn.18000d700
call fcn.180019620
call fcn.18003f584
cmp dword [rsp + 0x44], 1
jne 0x18003dfea
cmp dword [rsp + 0x40], 1
jne 0x18003dfe0
xor eax, eax
cmp eax, 1
je 0x18003dfde
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18003dfca
jmp 0x18003dfe8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
jmp 0x18003e036
cmp dword [rsp + 0x40], 1
jne 0x18003e02e
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [sym.imp.KERNEL32.dll_ExitProcess]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18003c864
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x18003e036
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x58
ret

Function at 0x18003e51c
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x68], 0
mov byte [rsp + 0x69], 5
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x64]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x18003e5c8
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x18003e5bd
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x60]
add rsp, 0x88
ret
Function at 0x18003e5d4
Capabilities:
Impersonate user

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.18003e22c
lea rax, [0x18006efb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
mov r9d, 9
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x18003e63b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x18
call fcn.18000f68c
jmp 0x18003e76a
mov rcx, qword [0x18006efb0]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x18003e663
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x19
call fcn.18000f68c
jmp 0x18003e76a
mov ecx, 0x800
call fcn.18001b0e0
mov qword [0x18006efd0], rax
mov edx, 0x200
mov rcx, qword [0x18006efd0]
call fcn.18001b450
mov qword [0x18006efb8], rax
mov edx, 0x200
mov rcx, qword [0x18006efd0]
call fcn.18001b450
mov qword [0x18006efc0], rax
mov edx, 0x400
mov rcx, qword [0x18006efd0]
call fcn.18001b450
mov qword [0x18006efc8], rax
mov r8d, 0x100
mov rdx, qword [0x18006efc0]
mov rcx, qword [rsp + 0x68]
call fcn.1800120b4
mov r8d, 0x100
mov rdx, qword [0x18006efb8]
mov rcx, qword [rsp + 0x60]
call fcn.1800120b4
mov r8d, 0x200
mov rdx, qword [0x18006efc8]
mov rcx, qword [rsp + 0x70]
call fcn.1800120b4
mov dword [0x18006efd8], 1
mov edx, 0x400
lea rcx, [rsp + 0x38]
call fcn.18000d374
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
lea rdx, str._s_s
lea rcx, [rsp + 0x38]
call fcn.18000d4dc
lea rcx, [rsp + 0x38]
call fcn.18000d4cc
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x38]
call fcn.18000d600
mov r8d, 0x23
mov ecx, dword [rsp + 0x30]
mov edx, ecx
mov rcx, rax
call qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.18000d338
add rsp, 0x58
ret

Function at 0x18003fa2c
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x20], eax
jae 0x18003faf6
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
xor r9d, r9d
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jg 0x18003fa95
mov eax, 0xffffffff
jmp 0x18003fafb
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 2
jb 0x18003faf1
mov eax, dword [rsp + 0x20]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x48]
movsx eax, byte [rcx + rax]
cmp eax, 0xa
jne 0x18003faf1
mov eax, dword [rsp + 0x20]
sub eax, 2
mov eax, eax
mov rcx, qword [rsp + 0x48]
movsx eax, byte [rcx + rax]
cmp eax, 0xd
jne 0x18003faf1
mov eax, dword [rsp + 0x20]
sub eax, 2
mov eax, eax
mov rcx, qword [rsp + 0x48]
mov byte [rcx + rax], 0
mov eax, dword [rsp + 0x20]
jmp 0x18003fafb
jmp 0x18003fa4f
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x18003fb00
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov word [rsp + 8], cx
sub rsp, 0x58
mov qword [rsp + 0x28], 0xffffffffffffffff
mov dword [rsp + 0x20], 0
call fcn.180010f00
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x18003fb59
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x18003fbfb
mov eax, 2
mov word [rsp + 0x38], ax
movzx ecx, word [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x3a], ax
mov dword [rsp + 0x3c], 0x100007f
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_bind]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x18003fba9
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x18003fbfb
mov edx, 0x78
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_listen]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x18003fbd1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x18003fbfb
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
call fcn.18003fce8
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [0x18003fc00]
call fcn.18003df0c
add rsp, 0x58
ret

Function at 0x180040f20
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.180040d88

Function at 0x180049620
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180049636
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180049638
xor eax, eax
test eax, eax
je 0x180049648
mov ecx, eax
call fcn.180042808
or eax, 0xffffffff
jmp 0x18004964a
xor eax, eax
add rsp, 0x28
ret

Function at 0x180049650
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180049668
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18004966a
xor eax, eax
test eax, eax
je 0x18004967a
mov ecx, eax
call fcn.180042808
or eax, 0xffffffff
jmp 0x18004967c
xor eax, eax
add rsp, 0x28
ret

Function at 0x180049684
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x18004969a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18004969c
xor eax, eax
test eax, eax
je 0x1800496ac
mov ecx, eax
call fcn.180042808
or eax, 0xffffffff
jmp 0x1800496ae
xor eax, eax
add rsp, 0x28
ret
Function at 0x40119c
Capabilities:
Terminate process

Disassembly:
add byte [rax], al
add byte [rcx - 0xdfdb94], cl
adc eax, 0xa88af
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.00488120
test eax, eax
jne 0x401276
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.00413910
mov r8d, dword [rsp + 0x20]
mov rcx, rax
mov edx, 8
call fcn.00413700
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x401276
mov dword [rsp + 0x140], 0x238
call fcn.00413910
lea r8, [rsp + 0x140]
mov rcx, rax
mov rdx, rbx
call fcn.00413680
test eax, eax
je 0x401241
mov r8d, dword [rsp + 0x148]
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x401241
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
cmovne edi, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.USER32.dll_GetFocus]
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x401253
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x401276
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetFocus]
mov eax, edi
mov rdi, qword [rsp + 0x388]
mov rsi, qword [rsp + 0x390]
mov rbp, qword [rsp + 0x398]
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x3a8
ret

Function at 0x4012a0
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x138
lea rdx, [rsp + 0x20]
call fcn.00401000
lea rdx, [rsp + 0x20]
lea rcx, [0x00401160]
call qword [sym.imp.USER32.dll_EnumWindows]
add rsp, 0x138
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x44cae0
add rcx, 0x1588
jmp 0x4012a0
Function at 0x401340
Capabilities:
Enumerate files on windows

Disassembly:
sub rsp, 0x198
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x188], rdi
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x30], rax
mov dl, 0x5c
mov rcx, rbx
call fcn.00499914
inc eax
mov r8d, eax
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.00499e24
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
mov r11, qword [0x004dfd00]
mov qword [rsp + 0x20], r11
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x40146d
nop
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.0049b398
lea rdx, [0x004a9cd4]
mov rcx, qword [rsp + 0x20]
call fcn.00485fd0
test eax, eax
je 0x40144d
lea rdx, [0x004a9cd0]
mov rcx, qword [rsp + 0x20]
call fcn.00485fd0
test eax, eax
je 0x40144d
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.0049b8ec
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
lea rcx, [rsp + 0x20]
call fcn.0049b664
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.0049a8fc
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4013d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
mov rbx, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x188]
add rsp, 0x198
ret
Function at 0x401788
Capabilities:
Delete directory
Delete file

Disassembly:
add dword [rax], eax
add al, ch
rcl byte [rax + 8], 0
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0x80], rdx
lea rdi, [rsp + 0x80]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x180]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x4017c0
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x80]
call fcn.004548a0
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.0049b290
nop
lea r8, [0x004a9d60]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.0049b8ec
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
mov edx, 0xa
lea rcx, [rsp + 0x40]
call fcn.0049a7a0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.00401340
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x4018fc
nop
nop
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.004012d0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, eax
call fcn.004545a0
test eax, eax
je 0x4018f4
mov r9d, edi
mov r8, qword [rsp + 0x20]
lea rdx, str.Delete_File_:__s____d_n
lea rcx, [rsp + 0x80]
call fcn.00486850
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x80]
call fcn.004548a0
cmp qword [rsp + 0x28], 0
jne 0x401880
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
mov byte [rcx + rbx - 2], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [rbx + 0x104], 0
call fcn.004545a0
test eax, eax
je 0x4019b2
invalid
invalid
add byte [rax], al
invalid
xor r8d, r8d

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
mov esi, eax
movabs eax, dword [0xda8b088900409214]
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [rsi], al
jne 0x407091
pop rsi
pop rbx
ret
Function at 0x416900
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x330
call fcn.004545a0
test eax, eax
je 0x416982
lea rdx, str.CUninstall_::_CloseControlPanel_n
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.00486850
movabs rdx, 0x203a5952544e45
xor eax, eax
mov qword [rsp + 0x120], rdx
lea rdi, [rsp + 0x120]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x416951
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
lea rdx, [rsp + 0x120]
mov rcx, rax
call fcn.004548a0
lea rcx, str.SHELL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x4169e8
lea r8, [rsp + 0x220]
mov r9d, 0x104
mov edx, 0x1041
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x4169dd
mov rax, qword [str.Control_Panel]
lea rcx, [rsp + 0x220]
mov qword [rcx], rax
mov eax, dword [0x004ac480]
mov dword [rcx + 8], eax
movzx eax, word [0x004ac484]
mov word [rcx + 0xc], ax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x416a0e
mov rax, qword [str.Control_Panel]
lea rcx, [rsp + 0x220]
mov qword [rcx], rax
mov eax, dword [0x004ac480]
mov dword [rcx + 8], eax
movzx eax, word [0x004ac484]
mov word [rcx + 0xc], ax
call fcn.004545a0
test eax, eax
je 0x416a42
lea r8, [rsp + 0x220]
lea rdx, str.Control_Panel_Title___s_n
lea rcx, [rsp + 0x20]
call fcn.00486850
call fcn.004546e0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.004548a0
lea rdx, [rsp + 0x220]
lea rcx, [0x00416830]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004545a0
test eax, eax
je 0x416ae1
lea rdx, str.CUninstall_::_CloseControlPanel_n
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.00486850
movabs rdx, 0x20203a54495845
xor eax, eax
mov qword [rsp + 0x120], rdx
lea rdi, [rsp + 0x120]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
nop
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x416ab0
call fcn.004546e0
lea rdx, [rsp + 0x120]
mov rcx, rax
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
add rsp, 0x330
pop rdi
ret
Function at 0x417d50
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x5b8
mov qword [rsp + 0x5b0], rbx
mov qword [rsp + 0x5a8], rdi
mov rbx, rdx
mov qword [rsp + 0x30], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x417df3
xor r8d, r8d
lea rdx, str.CUninstall::WaitForDevicePluggedInAfterDefer_n
lea rcx, [rsp + 0x80]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0x190], rdx
lea rdi, [rsp + 0x190]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x80]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x417dc2
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x190]
call fcn.004548a0
lea rcx, [rsp + 0x290]
call fcn.0043f4c0
nop
lea rcx, [rsp + 0x290]
call fcn.0043f930
nop
lea r9, str.WaitForDevicePluggedInAfterDeferWait
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [0x004dfd00]
mov qword [rsp + 0x20], rdx
mov r8d, 1
mov rdx, qword [rbx + 0x28]
lea rcx, [rsp + 0x40]
call fcn.0041dca0
nop
mov dword [rsp + 0x28], 0x104
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x80]
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.0041c440
test eax, eax
jne 0x417e8f
lea rcx, [rsp + 0x40]
call fcn.0041d010
nop
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
jmp 0x417e10
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.0049b398
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x40]
call fcn.0041d010
nop
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x3a0]
call fcn.004646c0
lea r8, str.UIUDeferredUninstall
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rsp + 0x3a0]
call fcn.00465350
lea rcx, [rsp + 0x290]
call fcn.0043fa90
call fcn.004545a0
test eax, eax
je 0x417f82
xor r8d, r8d
lea rdx, str.CUninstall::WaitForDevicePluggedInAfterDefer_n
lea rcx, [rsp + 0x80]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x190], rdx
lea rdi, [rsp + 0x190]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x80]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x417f50
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x190]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x290]
call fcn.00441430
mov rbx, qword [rsp + 0x5b0]
mov rdi, qword [rsp + 0x5a8]
add rsp, 0x5b8
ret
Function at 0x41c500
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], rsi
mov rsi, qword [rcx + 8]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
cmp rsi, 0xffffffffffffffff
mov qword [rsp + 0x48], r14
mov rdi, r9
mov rbp, r8
mov r12, rdx
je 0x41c5ad
lea rbx, [rcx + 0x10]
call fcn.00413910
mov dword [rsp + 0x30], 0x20019
mov r14d, 1
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov r9d, r14d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
call fcn.004131d0
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x41c5ad
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ebx, ebx
mov rcx, rsi
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x41c5ad
mov eax, dword [rdi]
mov dword [rdi], eax
jmp 0x41c5b5
mov dword [rdi], 0
xor eax, eax
mov r14, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x41c5e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rbp
mov rbp, qword [rcx + 8]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
mov rdi, qword [rsp + 0xb0]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r13
xor esi, esi
cmp rbp, 0xffffffffffffffff
mov qword [rsp + 0x50], r14
mov r13, r9
mov r14, r8
mov r12, rdx
je 0x41c6c3
lea rbx, [rcx + 0x10]
call fcn.00413910
mov dword [rsp + 0x30], 0x20019
mov r9d, 1
mov r8, rbx
mov rdx, rbp
mov rcx, rax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
call fcn.004131d0
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x41c6c3
lea r8, [rsp + 0x40]
mov rdx, r12
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41c6b0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
test eax, eax
mov eax, 1
cmove esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41c6c3
mov eax, dword [rdi]
mov dword [rdi], eax
jmp 0x41c6cb
mov dword [rdi], 0
xor eax, eax
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
add rsp, 0x88
ret