joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4047d0
Capabilities:
Query environment variable
Read file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x468
mov rax, qword [0x00472618]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
lea rdi, [rcx + 0x180]
mov rbx, rcx
lea rsi, [0x00458d94]
mov ecx, 4
repe cmpsb byte [rsi], byte [rdi]
jne 0x404835
lea rdx, [0x00403000]
lea rcx, [r11 - 0x218]
mov eax, dword [rdx + 0x55d8c]
mov dword [rcx], eax
movzx eax, word [rdx + 0x55d90]
mov word [rcx + 4], ax
jmp 0x404857
lea rdx, [0x00403000]
lea rcx, [rsp + 0x250]
mov eax, dword [rdx + 0x55d84]
mov dword [rcx], eax
movzx eax, word [rdx + 0x55d88]
mov word [rcx + 4], ax
lea rcx, str.USERPROFILE
call fcn.004355d0
test rax, rax
mov r11, rax
je 0x40487e
lea rdi, [0x00458e4b]
mov rsi, rax
mov ecx, 1
repe cmpsb byte [rsi], byte [rdi]
jne 0x40488d
lea rcx, str.WinDir
call fcn.004355d0
mov r11, rax
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x50], 0
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [r11 + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4048b0
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rcx, [rsp + 0x250]
xor edx, edx
nop
nop
movzx eax, byte [rcx + rdx]
add rdx, 1
test al, al
mov byte [rdi + rdx - 2], al
jne 0x4048e0
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.configconfig.sys]
xor esi, esi
mov qword [rdi - 1], rax
mov rax, qword [0x00458e38]
mov qword [rsp + 0x30], rsi
mov qword [rdi + 7], rax
movzx eax, word [0x00458e40]
lea r8d, [rsi + 1]
mov word [rdi + 0xf], ax
movzx eax, byte [0x00458e42]
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x2000001
mov byte [rdi + 0x11], al
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x4049a1
nop
nop
nop
nop
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x40]
mov r8d, 1
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4049d1
cmp dword [rsp + 0x44], esi
jne 0x4049dc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x488]
mov rsi, qword [rsp + 0x480]
mov rbx, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.00434a90
add rsp, 0x468
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x404998
movzx eax, byte [rsp + 0x40]
test al, al
jns 0x4049f0
movsx edx, al
add edx, 0x100
jmp 0x4049f3
movsx edx, al
cmp edx, 0xffffffff
je 0x404998
mov r8, rdi
mov rcx, rbx
call fcn.004045a0
jmp 0x404970
Function at 0x404de0
Capabilities:
Persist via run registry key

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x00472618]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, rcx
mov ecx, 0x7f0
call fcn.00417794
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rax, rax
je 0x404e30
mov rcx, rax
call fcn.004086a0
jmp 0x404e33
mov rax, rbx
mov rcx, rax
call fcn.00407a10
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 8
call fcn.00417794
mov qword [rsp + 0x20], rax
test rax, rax
je 0x404e65
mov rcx, rax
call fcn.00411f10
mov rbx, rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call fcn.00404430
lea r9, [rsp + 0x30]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rdx, 0xffffffff80000001
mov rcx, rbx
call fcn.00411fc0
lea r9, [rsp + 0x30]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rdx, 0xffffffff80000002
mov rcx, rbx
call fcn.00411fc0
test rbx, rbx
je 0x404ebb
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.00434a90
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret

Function at 0x404f30
Capabilities:
Create mailslot

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
lea rax, [rsp + 0x38]
lea rcx, [rsp + 0x38]
mov edx, 1
mov dword [rsp + 0x20], 0x18
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
lea rcx, [rsp + 0x38]
lea edx, [r9 + 1]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea r9, [rsp + 0x20]
xor edx, edx
mov r8d, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateMailslotA]
add rsp, 0x60
pop rbx
ret

Function at 0x404fa0
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
mov rax, rsp
sub rsp, 0x48
mov qword [rax + 0x10], rbx
xor ebx, ebx
mov qword [rax + 0x18], rsi
mov rsi, rdx
mov qword [rax + 0x20], rdi
lea r9, [rax - 0x14]
lea r8, [rax - 0x18]
xor edx, edx
mov rdi, rcx
mov dword [rax - 0x10], ebx
mov dword [rax - 0x14], ebx
mov dword [rax - 0x18], ebx
mov qword [rax - 0x28], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
test eax, eax
jne 0x404ff2
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
mov r8d, dword [rsp + 0x30]
cmp r8d, 0xffffffff
je 0x404fdc
lea r9, [rsp + 0x38]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
test eax, eax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x405120
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x00472618]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [r11 + 0x18], rbx
mov eax, edx
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
mov rdi, rcx
lea rdx, [r11 - 0x30]
mov ecx, eax
mov r8d, 0xa
call fcn.00435f20
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rsi, 0xffffffffffffffff
jne 0x40519a
mov eax, 0xffffffff
jmp 0x4051e5
xor eax, eax
lea rdi, [rsp + 0x48]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x48]
not rcx
mov qword [rsp + 0x20], rbx
mov r8d, ecx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405193
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne bl
mov eax, ebx
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.00434a90
add rsp, 0x78
ret
Function at 0x407e00
Capabilities:
Shutdown system

Disassembly:
mov r11, rsp
sub rsp, 0x108
mov rax, qword [0x00472618]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov qword [r11 + 0x10], rbx
mov ebx, ecx
lea rcx, [rsp + 0x50]
mov qword [r11 + 0x20], rdi
mov dword [rsp + 0x50], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x60], 1
jne 0x407ec6
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x407f8b
lea rdx, [0x004593f0]
mov rcx, rax
mov qword [rsp + 0x120], rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rsi, rax
je 0x407eb0
test ebx, ebx
jne 0x407ea7
lea rdx, str.Program_Manager
lea rcx, str.Progman
call qword [sym.imp.USER32.dll_FindWindowA]
lea edx, [rbx + 0x12]
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageA]
or ebx, 4
xor edx, edx
mov ecx, ebx
call rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x120]
jmp 0x407f8b
cmp ebx, 8
je 0x407ed9
cmp ebx, 2
je 0x407ed9
cmp ebx, 1
jne 0x407f7b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x407f10
lea r9d, [rax + 0x40]
lea r8, str._OpenProcessToken__Cannot_open_process_token
lea rdx, str._OpenProcessToken__Cannot_open_process_token
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x40]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x407f7b
lea r8, str._AdjustTokenPrivileges__Cannot_enable_shutdown_privilege
lea rdx, str._AdjustTokenPrivileges__Cannot_enable_shutdown_privilege
mov r9d, 0x40
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
or ebx, 4
mov edx, 0x80000000
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.00439cb0
mov rdi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x118]
int3
Function at 0x4086a0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
sub rsp, 0x2f8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x00472618]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
call fcn.0041c054
nop
lea rax, [0x004594d8]
mov qword [rbx], rax
lea rcx, [rbx + 0x180]
call fcn.00413c00
nop
lea rcx, [0x00459450]
mov qword [rbx + 0x668], rcx
xor edi, edi
mov qword [rbx + 0x670], rdi
mov qword [rbx + 0x688], rdi
mov qword [rbx + 0x680], rdi
mov qword [rbx + 0x678], rdi
lea rax, [0x00459470]
mov qword [rbx + 0x690], rax
mov qword [rbx + 0x698], rdi
mov qword [rbx + 0x6b0], rdi
mov qword [rbx + 0x6a8], rdi
mov qword [rbx + 0x6a0], rdi
mov qword [rbx + 0x6b8], rcx
mov qword [rbx + 0x6c0], rdi
mov qword [rbx + 0x6d8], rdi
mov qword [rbx + 0x6d0], rdi
mov qword [rbx + 0x6c8], rdi
mov dword [rbx + 0x658], edi
mov dword [rbx + 0x620], edi
mov qword [rbx + 0x640], rdi
mov qword [rbx + 0x628], rdi
mov byte [rsp + 0xe0], dil
xor edx, edx
mov r8d, 0x1ff
lea rcx, [rsp + 0xe1]
call fcn.00435390
mov dword [rsp + 0x40], 0x94
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x44], 6
jne 0x4087d3
cmp dword [rsp + 0x48], 1
jne 0x4087d3
mov dword [rbx + 0x664], 5
jmp 0x4087dd
mov dword [rbx + 0x664], 0xa
mov r8d, 0x200
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4087ff
xor ecx, ecx
call fcn.00439cb0
int3
mov ecx, 0x200
call fcn.00417794
mov qword [rsp + 0x20], rax
test rax, rax
je 0x408820
mov rcx, rax
call fcn.00404530
mov rsi, rax
jmp 0x408823
mov rsi, rdi
lea rdx, [rbx + 0x6e0]
mov rcx, rsi
call fcn.004044b0
mov ecx, 0xba0
call fcn.00417794
mov qword [rsp + 0x20], rax
test rax, rax
je 0x40885c
mov r8, rsi
lea rdx, [rsp + 0xe0]
mov rcx, rax
call fcn.0040c050
mov rdi, rax
mov qword [rbx + 0x178], rdi
mov rax, rbx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.00434a90
mov rbx, qword [rsp + 0x308]
mov rsi, qword [rsp + 0x310]
mov rdi, qword [rsp + 0x318]
add rsp, 0x2f8
ret
Function at 0x408980
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], rdi
mov rdi, rcx
lea rax, [0x004594d8]
mov qword [rcx], rax
mov rcx, qword [rcx + 0x628]
xor ebx, ebx
test rcx, rcx
je 0x4089d0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rdi + 0x628], rbx
lea rcx, [rdi + 0x180]
call fcn.00413840
nop
lea rbp, [0x00459450]
mov qword [rdi + 0x6b8], rbp
mov rcx, qword [rdi + 0x6c0]
test rcx, rcx
je 0x408a21
mov edx, ebx
cmp qword [rdi + 0x6c8], rdx
jle 0x408a1b
mov r8, qword [rdi + 0x6c8]
nop
nop
add edx, 1
movsxd rax, edx
cmp rax, r8
jl 0x408a10
call fcn.004177d8
nop
lea rax, [0x00459470]
mov qword [rdi + 0x690], rax
mov rcx, qword [rdi + 0x698]
test rcx, rcx
je 0x408a61
mov edx, ebx
cmp qword [rdi + 0x6a0], rdx
jle 0x408a5b
mov r8, qword [rdi + 0x6a0]
nop
add edx, 1
movsxd rax, edx
cmp rax, r8
jl 0x408a50
call fcn.004177d8
nop
mov qword [rdi + 0x668], rbp
mov rcx, qword [rdi + 0x670]
test rcx, rcx
je 0x408a96
cmp qword [rdi + 0x678], 0
jle 0x408a90
mov rdx, qword [rdi + 0x678]
add ebx, 1
movsxd rax, ebx
cmp rax, rdx
jl 0x408a85
call fcn.004177d8
nop
lea rcx, [rdi + 0x180]
call fcn.00414c40
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
jmp fcn.0041c1d4

Function at 0x409950
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov dword [rcx + 0x65c], edx
lea rax, [rsp + 0x48]
mov dword [rcx + 0x660], 1
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x00408b70]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x409990
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov dword [rcx + 0x65c], edx
lea rax, [rsp + 0x48]
mov dword [rcx + 0x660], 2
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x00408b70]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x4099d0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov dword [rcx + 0x65c], edx
lea rax, [rsp + 0x48]
mov dword [rcx + 0x660], 4
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x00408b70]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x409a10
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov dword [rcx + 0x65c], edx
lea rax, [rsp + 0x48]
mov dword [rcx + 0x660], 3
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x00408b70]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret
Function at 0x40b580
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x268
mov rax, qword [0x00472618]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov dword [rcx + 0x15c], 2
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x51]
mov r8d, 0x1ff
xor edx, edx
mov qword [r11 - 8], rdi
mov byte [rsp + 0x50], 0
call fcn.00435390
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rbx + rcx + 0x58c]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x40b5e1
movzx edx, word [0x00458f14]
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], dx
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
mov rax, qword [str.ipcBackupSet_]
mov rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
mov eax, dword [0x00459ba0]
mov dword [rdi + 7], eax
movzx eax, word [0x00459ba4]
mov word [rdi + 0xb], ax
movzx eax, byte [0x00459ba6]
mov byte [rdi + 0xd], al
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
xor r8d, r8d
nop
nop
movzx eax, byte [rsi + r8]
add r8, 1
test al, al
mov byte [rdi + r8 - 2], al
jne 0x40b660
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ebx, ebx
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], dx
mov qword [rsp + 0x30], rbx
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
mov eax, dword [str.stop]
lea r8d, [rbx + 1]
mov dword [rdi - 1], eax
movzx eax, byte [0x00459b94]
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov byte [rdi + 3], al
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x44]
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rdi, rax
mov byte [rsp + 0x40], 0x20
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.00434a90
add rsp, 0x268
ret
Function at 0x40b750
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
mov r11, rsp
sub rsp, 0x298
mov rax, qword [0x00472618]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov qword [r11 + 0x20], rbp
mov qword [r11 - 0x10], rdi
mov rdi, rcx
mov rbp, rdx
lea rcx, [r11 - 0x137]
mov r8d, 0x103
xor edx, edx
mov byte [rsp + 0x160], 0
call fcn.00435390
lea rcx, [rsp + 0x160]
add rdi, 0x178
sub rcx, rdi
nop
nop
movzx eax, byte [rdi]
add rdi, 1
test al, al
mov byte [rcx + rdi - 1], al
jne 0x40b7b0
xor eax, eax
lea rdi, [rsp + 0x160]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rax, [rsp + 0x160]
not rcx
cmp byte [rcx + rax - 2], 0x5c
je 0x40b802
xor eax, eax
lea rdi, [rsp + 0x160]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x00458f14]
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x160]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.jvm_bin_]
lea rcx, [rsp + 0x160]
mov qword [rdi - 1], rax
movzx eax, byte [0x00459bc8]
mov byte [rdi + 7], al
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40b898
lea rax, [rsp + 0x160]
mov rcx, rbp
lea rdx, [rsp + 0x160]
sub rcx, rax
nop
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x40b860
xor eax, eax
mov rdi, rbp
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.javaw.exe]
mov qword [rdi - 1], rax
movzx eax, word [0x00459bb8]
mov word [rdi + 7], ax
jmp 0x40b977
lea rdx, [rsp + 0x20]
lea rcx, str.bJW.EXE
mov qword [rsp + 0x2b0], rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x40b906
lea rax, [rsp + 0x160]
mov rdx, rbp
lea rcx, [rsp + 0x160]
sub rdx, rax
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rdx + rcx - 1], al
jne 0x40b8d1
xor eax, eax
mov rdi, rbp
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.javaw.exe]
mov qword [rdi - 1], rax
movzx eax, word [0x00459bb8]
mov word [rdi + 7], ax
jmp 0x40b96f
mov qword [rsp + 0x290], rsi
nop
lea rsi, [rsp + 0x4c]
lea rdi, [0x00458f1c]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x40b941
lea rsi, [rsp + 0x4c]
lea rdi, [0x00458f18]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x40b941
test byte [rsp + 0x20], 0x10
je 0x40b99f
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b910
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x40b910
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x290]
mov rbx, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x288]
mov rbp, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.00434a90
add rsp, 0x298
ret
lea rax, [rsp + 0x160]
mov rdx, rbp
lea rcx, [rsp + 0x160]
sub rdx, rax
nop
nop
nop
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rdx + rcx - 1], al
jne 0x40b9c0
xor eax, eax
mov rdi, rbp
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x4c]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x40b9f0
jmp 0x40b967
Function at 0x40ba20
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x278
mov rax, qword [0x00472618]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rsi
mov dword [rcx + 0x15c], 2
mov rsi, rdx
mov rbx, r8
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x1ff
mov qword [r11 - 0x10], rdi
mov byte [rsp + 0x50], 0
call fcn.00435390
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rbx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x40ba90
movzx edx, word [0x00458f14]
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], dx
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
mov rax, qword [str.ipcBackupSet_]
mov rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
mov eax, dword [0x00459ba0]
mov dword [rdi + 7], eax
movzx eax, word [0x00459ba4]
mov word [rdi + 0xb], ax
movzx eax, byte [0x00459ba6]
mov byte [rdi + 0xd], al
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
xor r8d, r8d
nop
nop
nop
movzx eax, byte [rsi + r8]
add r8, 1
test al, al
mov byte [rdi + r8 - 2], al
jne 0x40bb10
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ebx, ebx
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], dx
mov qword [rsp + 0x30], rbx
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
mov eax, dword [str.stop]
lea r8d, [rbx + 1]
mov dword [rdi - 1], eax
movzx eax, byte [0x00459b94]
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov byte [rdi + 3], al
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x44]
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rdi, rax
mov byte [rsp + 0x40], 0x20
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x268]
mov rsi, qword [rsp + 0x270]
mov rbx, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.00434a90
add rsp, 0x278
ret

Function at 0x40be30
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1058
call fcn.004573e0
sub rsp, rax
mov rax, qword [0x00472618]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov qword [rsp + 0x1078], rbx
mov qword [rsp + 0x1050], rdi
mov rdi, rdx
mov ebx, r8d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40bea8
xor ebx, ebx
nop
nop
nop
nop
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x1000
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40bea8
cmp dword [rsp + 0x30], ebx
jne 0x40be80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x1050]
mov rbx, qword [rsp + 0x1078]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.00434a90
add rsp, 0x1058
ret