joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003bb8
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, rcx
mov dword [rax - 0x18], 0x8007000e
mov ecx, Ordinal_35
mov ebp, r9d
mov rsi, r8
mov rdi, rdx
call fcn.14000123c
mov rbx, rax
test rax, rax
je 0x140003cd1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx + 8], rax
test rax, rax
je 0x140003cc9
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x140003cbf
mov eax, dword [rsp + 0x70]
lea r8, [0x140003710]
and qword [rsp + 0x28], 0
mov r9, rbx
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov dword [rbx + 0x1c], eax
mov qword [rbx], r14
mov dword [rbx + 0x18], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140003c9d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140003c84
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x30], ecx
jmp 0x140003c92
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003cb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rbx
call fcn.140001274
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140003e6c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov r14, r8
and qword [rbp - 8], rbx
mov rdi, rdx
and qword [rbp - 0x10], rbx
mov rsi, rcx
and qword [rbp + 0x20], rbx
cmp dword [rcx], ebx
je 0x140003ff9
add rcx, 8
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rsi + 0x30], 7
jge 0x140003ebf
mov ebx, 0x8007139f
jmp 0x140003fca
test rdi, rdi
je 0x140003fc5
test r14, r14
je 0x140003fc5
mov rdx, qword [rsi + 0x40]
sub rdx, rdi
movzx eax, word [rdi]
movzx ecx, word [rdi + rdx]
sub eax, ecx
jne 0x140003eeb
add rdi, 2
test ecx, ecx
jne 0x140003ed8
test eax, eax
je 0x140003ef9
mov ebx, 0x80070005
jmp 0x140003fca
lea rax, [rbp - 8]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CLSID
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003fb5
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov edi, 0x2001f
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003fb5
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x20]
mov r9d, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.LanguageCheckPeriod
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140003f89
mov rcx, qword [rbp - 0x10]
lea r8, [rbp + 0x20]
lea rdx, str.LanguageCheckPeriod
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140003fb5
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x3c]
mov r9d, 4
lea rdx, str.LastCheckedHi
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140003fca
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140003fca
mov ebx, 0x80070057
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140003fd9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140003fe8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140003ffe
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003ffe
mov ebx, 0x8007000e
cmp dword [rsi], 0
je 0x14000400d
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x1400069a4
Capabilities:
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x140015018]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edi, edi
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x140006a46
cmp dword [rbx + 0x10], 0
jne 0x140006a3d
cmp qword [rbx], 0
je 0x140006a3d
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call sub.msvcrt.dll_memset
mov rdx, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, 0x104
mov dword [rsp + 0x20], 0x104
mov rcx, rsi
call fcn.140006770
test eax, eax
je 0x140006a38
mov edx, 0x80
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x140006a38
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140006a3d
mov edi, 1
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1400069d5
mov eax, edi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000e250
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140006a74
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov rax, qword [0x140015018]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rcx
mov edi, 0x104
mov r8d, edi
lea rcx, [rbp + 0x70]
xor edx, edx
xor ebx, ebx
call sub.msvcrt.dll_memset
test rsi, rsi
je 0x140006c8e
cmp byte [rsi], bl
je 0x140006c8e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x140006c8e
lea rax, [rbp + 0x70]
mov r8, rsi
sub r8, rax
lea rcx, [rbp + 0x70]
mov edx, edi
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140006b0c
mov al, byte [r8 + rcx]
test al, al
je 0x140006b0c
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140006aed
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], bl
mov rax, rdx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
test rdx, rdx
je 0x140006c8e
lea rcx, [rbp + 0x70]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140006b3a
sub rdi, rax
lea r8, [0x140012274]
mov rdx, rdi
lea rcx, [rbp + 0x70]
call fcn.140005dd4
mov ebx, eax
test eax, eax
js 0x140006c8e
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140006b94
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140006c8e
lea rdx, [0x140012278]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140006c30
lea rdx, [0x14001227c]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140006c30
lea rax, [rsp + 0x5c]
mov r9, rsi
lea r8, [0x140012280]
mov qword [rsp + 0x20], rax
mov edx, 0x103
lea rcx, [rbp + 0x70]
call fcn.140005e98
mov ebx, eax
test eax, eax
js 0x140006c7f
test byte [rsp + 0x30], 0x10
lea rcx, [rbp + 0x70]
je 0x140006c17
mov edx, 0x90
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x70]
call fcn.140006a74
mov ebx, eax
test eax, eax
js 0x140006c7f
jmp 0x140006c30
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x140006c6b
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140006b94
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x140006c6b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rsi
or rdi, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x140006c8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp rdi, 0xffffffffffffffff
je 0x140006c8e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14000e250
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140006e00
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
xor r9d, r9d
and dword [rax - 0x20], 0
xor r8d, r8d
mov edx, 0x20000
mov dword [rax - 0x28], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140006ebd
and qword [rsp + 0x68], 0
lea rdx, [rsp + 0x68]
lea rcx, [0x140012288]
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x140006e9e
and qword [rsp + 0x60], 0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1400080d0
mov ebx, eax
test eax, eax
js 0x140006e91
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rsp + 0x60]
xor ebx, ebx
test eax, eax
sete bl
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140006eb2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006ed1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400073b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x140015018]
xor rax, rsp
mov qword [rbp + 0xf0], rax
cmp dword [0x140015750], 0
mov rsi, rdx
mov r14, rcx
mov edi, 1
mov ebx, 0x80004005
je 0x140007404
lea rcx, [0x140015758]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp edi, 0x1f4
jg 0x14000744d
lea rax, [0x14001229c]
mov dword [rsp + 0x28], edi
mov r9, r14
mov qword [rsp + 0x20], rax
lea r8, str._s_s_d.tmp
mov edx, 0x104
mov rcx, rsi
call fcn.140005e98
inc edi
mov ebx, eax
test eax, eax
js 0x140007557
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140007404
test ebx, ebx
js 0x140007557
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x48]
and qword [rsp + 0x48], 0
lea r9, [rbp + 0x50]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0xa0]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x70]
lea rax, [rbp]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.140007170
mov ebx, eax
test eax, eax
js 0x140007557
lea r8, [rsp + 0x50]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
mov r14d, 0x80070000
test eax, eax
jne 0x1400074ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140007537
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000000
xor r8d, r8d
mov edx, 0x1f0000
mov dword [rsp + 0x20], 3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140007526
mov edx, 0x1240
mov r8d, 0x1200a9
mov rcx, rax
call qword [sym.imp.iertutil.dll_Ordinal_134]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007537
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140007547
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140007557
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x140015750], 0
je 0x14000756d
lea rcx, [0x140015758]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.14000e250
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000759c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140015018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, rcx
mov r14, rdx
lea rcx, [rsp + 0x38]
mov edi, 0x80004005
xor esi, esi
xor ebx, ebx
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x14000761b
and qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x14000761b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
test rax, rax
je 0x140007609
mov rsi, rax
jmp 0x14000760e
mov ebx, 0x8007000e
lea rcx, [rsp + 0x30]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
jmp 0x140007629
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400076a4
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov rdx, rsi
call fcn.140006148
test eax, eax
js 0x14000769b
mov rbx, qword [rsp + 0x30]
lea r8, str._s_s
mov r9, rbp
mov qword [rsp + 0x20], rbx
mov edx, 0x104
mov rcx, r14
call fcn.140005e98
mov rcx, rbx
mov edi, eax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
js 0x14000769b
xor r8d, r8d
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
test eax, eax
jne 0x14000769b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000e250
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400076d0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x140015018]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov byte [rcx], 0
mov ecx, 0x104
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140007716
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400073b0
mov ecx, eax
jmp 0x14000772a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14000e250
add rsp, 0x140
pop rbx
ret
Function at 0x14000774c
Capabilities:
Copy file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x690
mov rax, qword [0x140015018]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov r14, r8
mov rdi, rdx
mov rbp, rcx
or rbx, 0xffffffffffffffff
call qword [sym.imp.ole32.dll_CoImpersonateClient]
xor r15d, r15d
test eax, eax
js 0x140007922
mov qword [rsp + 0x30], r15
lea r12d, [rbx + 2]
mov r8d, r12d
mov dword [rsp + 0x28], Ordinal_134
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.ole32.dll_CoRevertToSelf]
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140007922
mov rcx, rdi
call fcn.140006330
mov rsi, rax
cmp rax, rdi
je 0x140007922
lea rax, [rsp + 0x250]
mov edi, 0x104
mov dword [rsp + 0x28], edi
lea edx, [r15 + 8]
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1400078c2
lea r9, [rsp + 0x250]
mov qword [rsp + 0x20], rsi
lea r8, str._s_s.dat
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.140001c3c
mov edi, eax
test eax, eax
js 0x140007927
lea rcx, [rsp + 0x40]
call fcn.140007f10
mov edi, eax
test eax, eax
js 0x140007927
movzx eax, word [rsp + 0x40]
lea rcx, [rsp + 0x40]
jmp 0x140007876
cmp ax, 0x2f
jne 0x14000786f
mov eax, 0x5c
mov word [rcx], ax
add rcx, 2
movzx eax, word [rcx]
test ax, ax
jne 0x140007861
xor r9d, r9d
lea rdx, [rsp + 0x460]
mov r8d, 0x10c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
cmp eax, 3
je 0x140007922
cmp eax, 8
je 0x140007922
cmp eax, 0x57
je 0x140007922
mov r8d, r12d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x460]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400078f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
cmove eax, r12d
test eax, eax
jg 0x1400078e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov edi, eax
cmove edi, r12d
jmp 0x140007927
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
cmove eax, r12d
movzx edi, ax
or edi, 0x80070000
jmp 0x140007927
lea rcx, [rsp + 0x40]
call fcn.140006cc0
mov edi, eax
test eax, eax
js 0x140007927
mov rcx, qword [r14]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [r14], rax
jmp 0x140007927
mov edi, 0x80004005
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000793a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.14000e250
add rsp, 0x690
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140007964
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x140015018]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbp, rcx
mov r14d, 1
mov rcx, qword [rdx]
mov ebx, r14d
mov rdi, rdx
call fcn.140006330
mov rsi, rax
cmp rax, qword [rdi]
je 0x140007ac2
lea rax, [rsp + 0x240]
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbp
lea edx, [r14 + 7]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140007a14
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
cmove eax, r14d
test eax, eax
jg 0x1400079fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
cmove eax, r14d
jmp 0x140007ac7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
cmove eax, r14d
movzx eax, ax
or eax, 0x80070000
jmp 0x140007ac7
cmp ebx, 0x1f4
jg 0x140007ac2
mov qword [rsp + 0x28], rsi
lea r9, [rsp + 0x240]
lea r8, str._s__d__s
mov dword [rsp + 0x20], ebx
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140001c3c
add ebx, r14d
test eax, eax
js 0x140007a5e
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140007a14
lea rcx, [rsp + 0x30]
call fcn.14000d1f0
mov ebx, eax
test eax, eax
js 0x140007abe
lea rcx, [rsp + 0x30]
call fcn.140007f10
mov ebx, eax
test eax, eax
js 0x140007abe
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400079da
lea rcx, [rsp + 0x30]
call fcn.140006cc0
mov ebx, eax
test eax, eax
js 0x140007abe
mov rcx, qword [rdi]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
mov eax, ebx
jmp 0x140007ac7
mov eax, 0x80004005
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000e250
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400085d8
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
and qword [rax - 0x18], rbx
xor r8d, r8d
mov dword [rax - 0x20], 0x2000000
mov edx, 0x20000
mov dword [rax - 0x28], 3
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400086a2
and qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x60]
lea rcx, [0x14001240c]
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x140008699
and qword [rsp + 0x58], rbx
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400080d0
test eax, eax
js 0x140008665
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
sete bl
jmp 0x14000867e
cmp eax, 0x8007053c
jne 0x14000867e
mov rcx, rsi
call fcn.14000cde4
test eax, eax
mov ecx, 1
cmovne ebx, ecx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000868e
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140009f60
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x140009f8e
xor al, al
jmp 0x140009fcc
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x140009f9f
xor al, al
jmp 0x140009fcc
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x140009fc6
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x140009fc6
mov al, 1
jmp 0x140009fcc
xor al, al
jmp 0x140009fcc
add rsp, 0x50
pop rbx
ret

Function at 0x14000a03c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
mov esi, 0x10000
test rax, rax
je 0x14000a064
sub rbx, rax
add rbx, rsi
cmp rbx, rdi
jae 0x14000a0fd
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x14000a083
mov ebx, 0x80010000
jmp 0x14000a064
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x30]
call sub.msvcrt.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000a0fd
mov rcx, qword [rsp + 0x38]
cmp dword [rsp + 0x40], esi
jne 0x14000a0db
cmp rcx, rsi
jb 0x14000a0db
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000a0ff
jmp 0x14000a061
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x14000a064
mov rax, rsi
sub rax, rcx
add rbx, rax
jmp 0x14000a064
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14000a118
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x14000a1e2
mov esi, 0x10000
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x14000a165
mov ebx, 0x4fff0000
jmp 0x14000a1d9
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x30]
call sub.msvcrt.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000a1e2
cmp dword [rsp + 0x40], esi
jne 0x14000a1bd
cmp qword [rsp + 0x38], rsi
jb 0x14000a1bd
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000a1e4
sub rbx, rsi
jmp 0x14000a1d9
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x14000a14f
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret