joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400062f4
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.140006250
test al, al
jne 0x140006319
mov eax, 0x80070002
jmp 0x14000634a
mov rcx, rdi
mov ebx, 4
call fcn.14000629c
test al, al
lea ecx, [rbx + 1]
mov rdx, rsi
cmove ebx, ecx
mov rcx, rdi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140006348
call fcn.14000b1b0
jmp 0x14000634a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400065e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rcx
test edx, edx
jle 0x140006707
mov r10, r8
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
jmp 0x140006663
sub r9d, 4
js 0x140006707
movzx eax, byte [r11]
shr rax, 2
mov al, byte [rax + rbx]
mov byte [r10], al
movzx eax, byte [r11 + 1]
movzx ecx, byte [r11]
shr eax, 4
and ecx, 3
shl ecx, 4
add ecx, eax
mov al, byte [rcx + rbx]
mov byte [r10 + 1], al
movzx eax, byte [r11 + 2]
movzx ecx, byte [r11 + 1]
shr eax, 6
and ecx, 0xf
lea eax, [rax + rcx*4]
mov al, byte [rax + rbx]
mov byte [r10 + 2], al
movzx eax, byte [r11 + 2]
add r11, 3
and eax, 0x3f
mov al, byte [rax + rbx]
mov byte [r10 + 3], al
add r10, 4
sub edx, 3
cmp edx, 2
jg 0x1400065fc
sub edx, 1
je 0x1400066c7
cmp edx, 1
jne 0x1400066ff
sub r9d, 3
js 0x140006707
movzx eax, byte [r11]
shr rax, 2
mov al, byte [rax + rbx]
mov byte [r10], al
movzx ecx, byte [r11]
movzx eax, byte [r11 + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, eax
mov al, byte [rcx + rbx]
mov byte [r10 + 1], al
movzx eax, byte [r11 + 1]
and eax, 0xf
mov al, byte [rbx + rax*4]
mov byte [r10 + 2], al
lea eax, [r9 - 1]
test eax, eax
js 0x140006707
mov byte [r10 + 3], 0x3d
jmp 0x1400066fb
sub r9d, 2
js 0x140006707
movzx eax, byte [r11]
shr rax, 2
mov al, byte [rax + rbx]
mov byte [r10], al
movzx eax, byte [r11]
and eax, 3
add rax, rax
mov cl, byte [rbx + rax*8]
mov byte [r10 + 1], cl
lea ecx, [r9 - 2]
test ecx, ecx
js 0x140006707
mov word [r10 + 2], 0x3d3d
add r10, 4
sub r10d, r8d
mov eax, r10d
jmp 0x140006709
xor eax, eax
mov rbx, qword [rsp + 8]
ret
Function at 0x140006ef8
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xe0
mov rbp, rdx
mov dword [rax - 0x78], 0x68
xor edx, edx
lea rcx, [rax - 0x70]
mov rsi, r8
mov edi, r9d
lea r8d, [rdx + 0x60]
call fcn.140020690
mov rbx, qword [rsp + 0x110]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rbx
xor ecx, ecx
mov qword [rsp + 0x40], rax
xor r9d, r9d
and qword [rsp + 0x38], rcx
xor r8d, r8d
mov dword [rsp + 0xac], 0x80
mov rdx, rbp
test rsi, rsi
jne 0x140006f70
and qword [rsp + 0x30], rsi
and dword [rsp + 0x28], esi
jmp 0x140006f7d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140006f92
call fcn.14000b1b0
jmp 0x140006fe0
mov al, byte [0x140054cc1]
lea rdx, [0x140054b70]
neg al
sbb rcx, rcx
and rcx, rdx
je 0x140006fde
mov edx, 7
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x58], edx
lea r8d, [rdx - 6]
mov dword [rsp + 0x5c], r8d
call fcn.140007d4c
mov r8d, dword [rbx + 0x10]
lea rdx, str._Started_process___u_
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x60], eax
call fcn.14000410c
xor eax, eax
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140007664
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rdx
call fcn.1400014bc
xor esi, esi
mov rcx, rax
test rax, rax
je 0x140007763
mov rax, qword [rax]
call qword [rax + 0x18]
lea ecx, [rsi + 1]
mov edx, 0x104
lea rbx, [rax + 0x18]
mov eax, dword [rbx - 0xc]
sub ecx, dword [rbx - 8]
sub eax, edx
or ecx, eax
mov qword [rsp + 0x40], rbx
jge 0x1400076c0
lea rcx, [rsp + 0x40]
call fcn.140001ac4
mov rbx, qword [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x23]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1400076e0
mov rcx, rdi
jmp 0x1400076f7
lea rdx, str.GoogleUpdateLog
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rcx, rdi
test eax, eax
jne 0x140007757
lea rdx, [0x140046d08]
call fcn.140005328
test rbx, rbx
jne 0x14000770c
mov eax, esi
jmp 0x14000771c
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14002c108
test eax, eax
js 0x14000776e
cmp eax, dword [rbx - 0xc]
jg 0x14000776e
mov dword [rbx - 0x10], eax
lea rdx, [rbx - 0x18]
cdqe
mov word [rbx + rax*2], si
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007744
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x48]
mov rax, rdi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rdx, [rsp + 0x40]
call fcn.1400053b4
jmp 0x140007703
mov ecx, 0x80004005
call fcn.140001814
int3
mov ecx, 0x80070057
call fcn.140001814
int3
Function at 0x1400078e8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x148], 0
mov rbp, rcx
jne 0x140007938
mov ecx, 0x40
call fcn.140033264
mov rcx, rax
call fcn.14000b978
mov qword [rbp + 0x148], rax
test rax, rax
jne 0x140007938
mov rdx, qword [rbp + 0x58]
lea rcx, str.LOG_SYSTEM:___s_:_ERROR___Cannot_create_ETW_log_writer
call fcn.14000b74c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x148]
test rcx, rcx
je 0x14000795e
movsxd rax, dword [rbp + 0xb8]
cmp eax, 0xf
jge 0x14000795e
mov qword [rbp + rax*8 + 0xc0], rcx
inc dword [rbp + 0xb8]
cmp byte [rbp + 0x93], 0
je 0x140007ab4
cmp qword [rbp + 0x138], 0
jne 0x140007a8e
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.14000777c
mov rdi, qword [rsp + 0x40]
cmp dword [rdi - 0x10], 0
jne 0x1400079b7
lea rdx, [rdi - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140007ab4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140007ab4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14000b2c8
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.140006250
test al, al
jne 0x140007a0b
mov rcx, rbx
call fcn.14000486c
test eax, eax
jns 0x140007a0b
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140007a00
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
jmp 0x140007998
mov sil, byte [rbp + 0xa1]
mov ecx, 0x38
call fcn.140033264
mov r8b, sil
mov rdx, rdi
mov rcx, rax
call fcn.1400084a8
mov qword [rbp + 0x138], rax
test rax, rax
jne 0x140007a52
mov rdx, qword [rbp + 0x58]
lea rcx, str.LOG_SYSTEM:___s_:_ERROR___Cannot_create_log_writer_to__s
mov r8, rdi
call fcn.14000b74c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140007a6f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x40]
mov eax, ebx
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140007a8e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp + 0x138]
test rcx, rcx
je 0x140007ab4
movsxd rax, dword [rbp + 0xb8]
cmp eax, 0xf
jge 0x140007ab4
mov qword [rbp + rax*8 + 0xc0], rcx
inc dword [rbp + 0xb8]
cmp byte [rbp + 0xa0], 0
je 0x140007b06
mov rcx, qword [rbp + 0x140]
test rcx, rcx
jne 0x140007aec
mov ecx, 8
call fcn.140033264
mov rcx, rax
lea rax, fcn.1400024b8
mov qword [rcx], rax
mov qword [rbp + 0x140], rcx
test rcx, rcx
je 0x140007b06
movsxd rax, dword [rbp + 0xb8]
cmp eax, 0xf
jge 0x140007b06
mov qword [rbp + rax*8 + 0xc0], rcx
inc dword [rbp + 0xb8]
cmp dword [rbp + 0xb8], 0
mov rbx, qword [rsp + 0x50]
setg al
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007b20
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp byte [rcx + 0xa2], 1
jne 0x140007b66
lea rcx, [rsp + 0x48]
call fcn.140007004
mov rdx, qword [rax]
lea rcx, str.LOG_SYSTEM:___s_:_ERROR___Calling_the_logging_system_after_it_has_been_shut_down__n
call fcn.14000b74c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x48]
call fcn.140001920
xor al, al
jmp 0x140007bb7
cmp byte [rcx + 0x50], 1
jne 0x140007b70
mov al, 1
jmp 0x140007bb7
cmp byte [rcx + 0x51], 0
je 0x140007b7a
xor al, al
jmp 0x140007bb7
mov byte [rcx + 0x51], 1
call fcn.1400073c4
cmp byte [rbx + 0x90], 0
je 0x140007b97
mov rcx, rbx
call fcn.1400078e8
mov byte [rbx + 0x50], al
mov byte [rbx + 0x51], 0
mov al, 1
jmp 0x140007bb7
add rsp, 0x30
pop rbx
ret

Function at 0x140007bc0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov al, 1
mov rbx, rcx
cmp byte [rcx + 0xa2], al
jne 0x140007c1c
lea rcx, [rsp + 0x30]
call fcn.140007004
lea rcx, str.LOG_SYSTEM:___s_:_ERROR___Calling_the_logging_system_after_it_has_been_shut_down__n
mov rdx, qword [rax]
call fcn.14000b74c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007c18
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor al, al
jmp 0x140007c43
cmp byte [rcx + 0x50], al
je 0x140007c43
lea rdi, [rcx + 0x60]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov rcx, rbx
call fcn.140007b20
mov rdx, qword [rdi]
mov rcx, rdi
mov bl, al
call qword [rdx + 0x10]
mov al, bl
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400080c8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rsi, qword [rsp + 0xa0]
mov ebp, r9d
mov r12d, r8d
mov r14d, edx
mov r13, rcx
test rsi, rsi
je 0x14000822c
test edx, edx
jne 0x14000810f
cmp r9d, 2
jg 0x14000822c
call fcn.1400014bc
test rax, rax
je 0x14000824a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.1400014bc
test rax, rax
je 0x14000824a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov edi, 1
lea r15, [r13 + 0x60]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xa0], rbx
xor edx, edx
mov rcx, r15
call fcn.140009670
test al, al
jne 0x14000817d
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x14
jle 0x14000815b
jmp 0x1400081c8
mov rax, qword [rsp + 0xa8]
mov r9d, ebp
mov qword [rsp + 0x38], rax
mov r8d, r12d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov edx, r14d
lea rax, [rsp + 0x40]
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.140007e40
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
mov rbx, qword [rsp + 0xa0]
cmp edi, 0x14
jle 0x1400081f0
lea rcx, str.LOG_SYSTEM:_Couldnt_acquire_lock__
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x14004a428]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14000820d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x40]
mov eax, ebx
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14000822c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.140001814
int3
Function at 0x1400084a8
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and word [rcx + 0xc], 0
lea rax, fcn.1400086a4
mov ebp, 1
mov qword [rcx], rax
mov byte [rcx + 0xf], bpl
mov rbx, rdx
mov rdi, rcx
mov dword [rcx + 8], 0x989680
mov byte [rcx + 0xe], r8b
call fcn.1400014bc
test rax, rax
je 0x1400085f4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rcx, [rdi + 0x20]
mov rdx, rbx
add rax, 0x18
mov qword [rdi + 0x10], rax
and qword [rdi + 0x18], 0
call fcn.140005328
and qword [rdi + 0x28], 0
call fcn.1400014bc
test rax, rax
je 0x1400085f4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rcx, [0x140054b70]
mov qword [rdi + 0x30], rax
mov al, byte [0x140054cc1]
neg al
sbb rsi, rsi
and rsi, rcx
je 0x1400085de
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14000842c
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 0x10], 0
je 0x1400085ac
mov r9, rbx
lea rdx, str.MaxLogFileSize
mov r8d, 0x989680
lea rcx, str.LoggingSettings
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r9, rbx
lea rdx, str.LogFileWide
lea rcx, str.LoggingSettings
mov dword [rdi + 8], eax
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
setne bpl
jmp 0x1400085b3
mov dword [rdi + 8], 0x989680
lea rdx, [rsi + 0x58]
mov byte [rdi + 0xf], bpl
lea rcx, [rdi + 0x30]
call fcn.140001838
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400085de
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x48]
mov rax, rdi
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140001814
int3
Function at 0x1400086dc
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r15, rcx
lea r8, [rcx + 0x20]
lea rcx, [rbp + 0x50]
lea rdx, str._Google_Update_logging_mutex_
call fcn.14000910c
or r12d, 0xffffffff
mov r14, rax
xor edi, edi
mov r9, qword [rax]
mov rdx, r9
movzx r8d, word [r9]
jmp 0x140008729
cmp r8w, 0x5c
je 0x140008748
add rdx, 2
movzx r8d, word [rdx]
test r8w, r8w
jne 0x14000871a
mov edx, r12d
cmp edx, r12d
jne 0x140008750
mov rdx, r14
lea rcx, [rbp + 0x48]
call fcn.1400053b4
jmp 0x1400087dc
sub rdx, r9
sar rdx, 1
jmp 0x140008732
call fcn.1400014bc
mov rcx, rax
test rax, rax
je 0x1400088f3
mov rax, qword [rax]
call qword [rax + 0x18]
mov esi, edi
lea rbx, [rax + 0x18]
mov rax, qword [r14]
mov qword [rbp + 0x40], rbx
cmp dword [rax - 0x10], edi
jle 0x1400087b3
mov rbx, rdi
test rbx, rbx
js 0x1400088e8
cmp esi, dword [rax - 0x10]
jg 0x1400088e8
movzx edx, word [rbx + rax]
cmp dx, 0x5c
je 0x1400087a4
lea rcx, [rbp + 0x40]
call fcn.1400054b4
mov rax, qword [r14]
inc esi
add rbx, 2
cmp esi, dword [rax - 0x10]
jl 0x14000877c
mov rbx, qword [rbp + 0x40]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.1400053b4
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x1400087dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [rbp + 0x48]
lea rcx, [r15 + 0x10]
call fcn.140001838
mov rdx, qword [rbp + 0x48]
mov eax, r12d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140008809
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x50]
mov eax, r12d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140008829
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rsi, [0x140049b88]
mov qword [rbp - 0x38], rdi
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], rsi
call fcn.140004204
mov rdx, qword [rbp - 0x38]
mov rax, rdi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rax
test rdx, rdx
je 0x140008862
lea rcx, [rbp - 0x18]
call fcn.140003938
mov rax, qword [rbp - 0x10]
mov rbx, qword [r15 + 0x10]
mov dword [rbp - 0x30], 0x18
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], edi
call fcn.140009434
mov rax, qword [0x140054880]
lea rcx, [rbp - 0x30]
test rax, rax
je 0x140008899
mov r9d, 0x100001
xor r8d, r8d
mov rdx, rbx
call rax
jmp 0x1400088a4
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [r15 + 0x18], rax
test rax, rax
je 0x1400088bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete dil
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x18], rsi
call fcn.140003860
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], rsi
call fcn.140003860
mov al, dil
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.140001814
int3
mov ecx, 0x80004005
call fcn.140001814
int3
Function at 0x140008abc
Capabilities:
Move file
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rcx, str.LOG_SYSTEM:_trying_to_move_log_file_to_backup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdi, [rsi + 0x20]
mov rdx, rdi
lea r8, str..bak
lea rcx, [rsp + 0x30]
call fcn.140005fd8
mov rbx, qword [rsp + 0x30]
mov r8d, 0xb
mov rcx, qword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140008b15
call fcn.14000b1b0
jmp 0x140008b17
xor eax, eax
test eax, eax
jns 0x140008b44
lea rcx, str.LOG_SYSTEM:_failed_to_move_log_file_to_backup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rsi
call fcn.140008b78
test al, al
jne 0x140008b3f
mov rcx, qword [rdi]
mov rdx, rbx
call fcn.1400062f4
xor dil, dil
jmp 0x140008b47
mov dil, 1
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140008b62
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rbx, qword [rsp + 0x38]
mov al, dil
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140008b78
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rbp + 0x27], rax
movaps xmm0, xmmword [str.SYSTEMCurrentControlSetControlSession_Manager]
lea rdx, [rbp - 0x49]
movaps xmm1, xmmword [0x14004a6e0]
mov rdi, rcx
movzx eax, word [0x14004a730]
xor r12d, r12d
movaps xmmword [rbp - 0x49], xmm0
mov r9d, 0x20019
movaps xmm0, xmmword [0x14004a6f0]
xor r8d, r8d
movaps xmmword [rbp - 0x39], xmm1
mov rcx, 0xffffffff80000002
movaps xmm1, xmmword [0x14004a700]
movaps xmmword [rbp - 0x29], xmm0
movaps xmm0, xmmword [0x14004a710]
movaps xmmword [rbp - 0x19], xmm1
movaps xmm1, xmmword [0x14004a720]
mov word [rbp + 0x17], ax
lea rax, [rbp - 0x61]
movaps xmmword [rbp - 9], xmm0
movaps xmmword [rbp + 7], xmm1
mov qword [rbp - 0x61], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008d65
mov rcx, qword [rbp - 0x61]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x65]
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea rdx, str.PendingFileRenameOperations
mov dword [rbp - 0x69], r12d
mov dword [rbp - 0x65], 7
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008d65
cmp dword [rbp - 0x65], 7
jne 0x140008d65
mov ecx, dword [rbp - 0x69]
call fcn.1400332c0
mov r8d, dword [rbp - 0x69]
xor edx, edx
mov rcx, rax
mov qword [rbp - 0x59], rax
mov rbx, rax
call fcn.140020690
mov rcx, qword [rbp - 0x61]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
lea rdx, str.PendingFileRenameOperations
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008d50
mov esi, dword [rbp - 0x69]
shr rsi, 1
lea rax, [rsi - 2]
cmp rax, 0xffffd
ja 0x140008d50
cmp word [rbx + rsi*2 - 4], r12w
jne 0x140008d50
cmp word [rbx + rsi*2 - 2], r12w
jne 0x140008d50
lea r8, [rdi + 0x20]
lea rdx, str.___
lea rcx, [rbp - 0x51]
call fcn.14000910c
mov rdi, qword [rbp - 0x51]
mov r14d, r12d
test rsi, rsi
je 0x140008d24
lea r15, [rbx + r14*2]
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140008d28
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
inc rcx
add r14, rcx
cmp r14, rsi
jb 0x140008cf9
or r14d, 0xffffffff
cmp r14d, 0xffffffff
lea rdx, [rdi - 0x18]
setne sil
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008d4a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x59]
jmp 0x140008d53
mov sil, r12b
test rbx, rbx
je 0x140008d60
mov rcx, rbx
call fcn.14001fd2c
mov al, sil
jmp 0x140008d67
xor al, al
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14001fa80
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140009090
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x1400090a6
xor al, al
jmp 0x1400090dd
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x1400090db
mov r8, qword [rbx + 0x10]
lea rcx, str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
mov rdx, qword [rbx + 0x30]
call fcn.14000b74c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [rbx + 0xd], 0
jmp 0x1400090a2
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140009670
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 8]
mov esi, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
jne 0x1400096bf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
jne 0x1400096bf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, esi
jb 0x14000969a
xor al, al
jmp 0x1400096c1
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret