joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003d30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14015a038]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov qword [rbp - 0x40], r15
lea rcx, [rbp - 0x40]
call fcn.1400d9744
mov eax, dword [rbp - 0x40]
mov dword [rdi], eax
mov bl, 1
mov rax, qword [rsi]
cmp dword [rax + 0xd4], 1
ja 0x140003f4c
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
lea ecx, [r15 + 0x48]
call fcn.14009b4d4
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x38]
call fcn.14001a890
mov rdx, qword [rsi]
add rdx, 0x3c8
lea rcx, [rbp - 0x38]
call fcn.14001b250
mov r8d, 0x2792
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x38]
call fcn.14001a110
nop
mov rax, qword [rsi]
movzx r14d, byte [rax + 0x529]
test r14b, r14b
jne 0x140003e34
mov dword [0x14015e5f4], r15d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [0x14015e658], rax
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [0x14015ae88]
call fcn.1400123a0
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140026590]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9, rdi
lea rdx, str.time.windows.com
call fcn.14001e1b0
test eax, eax
jne 0x140003e5e
mov r9, rdi
lea rdx, str.time.nist.gov
call fcn.14001e1b0
test eax, eax
jne 0x140003e5e
xor bl, bl
jmp 0x140003e60
mov bl, 1
test r14b, r14b
jne 0x140003e89
mov dword [0x14015e5f4], 1
mov rcx, qword [0x14015eb88]
test rcx, rcx
je 0x140003e89
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PostMessageW]
test bl, bl
jne 0x140003eb0
mov rax, qword [rsi]
cmp dword [rax + 0xd4], 1
jne 0x140003e9d
mov bl, 1
jmp 0x140003eca
mov edx, 0x1010
lea rcx, str.This_workbook_needs_to_check_for_the_Internet_Time_before_you_open_it._r_nPlease_make_sure_you_are_connected_to_the_Internet_when_you_open_it.
call fcn.140022d20
jmp 0x140003edc
mov eax, dword [rdi]
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x40]
call fcn.1400d9358
test rax, rax
je 0x140003eca
cmp dword [rax + 0x14], 0x78
jle 0x140003edc
mov qword [rbp - 0x40], r15
lea rcx, [rbp - 0x40]
call fcn.1400d9744
mov eax, dword [rbp - 0x40]
mov dword [rdi], eax
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140003f18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f6f
call fcn.14009b510
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r15w
mov r8, qword [rbp - 0x38]
mov r8, qword [r8 + 8]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x38]
call fcn.14001ce40
mov edx, 0x48
mov rcx, qword [rbp - 0x38]
call fcn.14009b510
movzx eax, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14009b5b0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400ac408
nop
int3
Function at 0x140010d80
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rbx, rcx
xor r15d, r15d
mov qword [rcx], r15
mov r14d, r9d
lea rcx, str.advapi32.dll
mov rsi, r8
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x140010dce
lea rcx, str.advapi32.dll
call fcn.140011340
mov rdi, rax
lea rdx, [0x14012e5c8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegCreateKeyExW
mov rcx, rdi
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14012e5e8]
mov rcx, rdi
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegSetValueExW
mov rcx, rdi
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegEnumKeyExW
mov rcx, rdi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegEnumValueW
mov rcx, rdi
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegDeleteValueW
mov rcx, rdi
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14012e640]
mov rcx, rdi
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
mov qword [rbx + 0x18], rax
test rcx, rcx
je 0x140010e7b
call rax
mov qword [rbx], r15
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
test r14d, r14d
je 0x140010e97
lea r9d, [r8 + 1]
mov qword [rsp + 0x20], rbx
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140010ecd
lea rax, [rsp + 0x88]
mov dword [rsp + 0x88], r15d
mov qword [rsp + 0x40], rax
lea r9, [0x14012e64c]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [rbx + reloc.WS2_32.dll_recv]
mov rbp, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x140011340
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x48], rbx
cmp dword [0x14015e5ac], ebx
jne 0x1400113fb
mov eax, dword [0x14015e5b0]
test eax, eax
jne 0x1400113fb
mov edx, dword [0x14015e5a8]
test edx, edx
je 0x14001139b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14015e5b0]
mov edx, dword [0x14015e5a8]
test eax, eax
jne 0x1400113fb
test edx, edx
jne 0x1400113ac
call fcn.1400110c0
test eax, eax
je 0x1400113c2
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14015ac80]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x1400113fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x1400113f1
cmp eax, 0x78
je 0x1400113f1
cmp eax, 1
je 0x1400113f1
cmp eax, 0x32
je 0x1400113f1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [0x14015e5b0], 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
mov qword [rsp + 0x20], rax
cmp dword [0x14015e5ac], 0
je 0x14001141e
cmp dword [0x14015e5b0], 0
jne 0x14001144c
mov edi, ebx
test rsi, rsi
sete dil
test edi, edi
je 0x140011433
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x14001144c
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140012820
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x50], rbx
cmp dword [0x14015e5ac], ebx
jne 0x1400128e1
mov eax, dword [0x14015e5b0]
test eax, eax
jne 0x1400128e1
mov r8d, dword [0x14015e5a8]
test r8d, r8d
je 0x140012880
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14015e5b0]
mov r8d, dword [0x14015e5a8]
test eax, eax
jne 0x1400128e1
test r8d, r8d
jne 0x140012892
call fcn.1400110c0
test eax, eax
je 0x1400128a8
lea rdx, [rsp + 0x50]
mov rcx, qword [0x14015ac80]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x1400128e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x1400128d7
cmp eax, 0x78
je 0x1400128d7
cmp eax, 1
je 0x1400128d7
cmp eax, 0x32
je 0x1400128d7
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [0x14015e5b0], 1
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov esi, eax
mov dword [rsp + 0x20], eax
cmp dword [0x14015e5ac], 0
je 0x140012905
cmp dword [0x14015e5b0], 0
jne 0x140012932
mov edi, ebx
test esi, esi
sete dil
test edi, edi
je 0x140012919
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x140012932
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400139a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x40
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov qword [rsp + 0x30], 0xffffffffffffffff
xor edi, edi
mov qword [rsp + 0x70], rdi
cmp dword [0x14015e5ac], edi
jne 0x140013a87
mov eax, dword [0x14015e5b0]
test eax, eax
jne 0x140013a87
mov r8d, dword [0x14015e5a8]
test r8d, r8d
je 0x140013a16
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14015e5b0]
mov r8d, dword [0x14015e5a8]
test eax, eax
jne 0x140013a87
test r8d, r8d
jne 0x140013a28
call fcn.1400110c0
test eax, eax
je 0x140013a3e
lea rdx, [rsp + 0x70]
mov rcx, qword [0x14015ac80]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x140013a87
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x140013a7d
cmp eax, 0x78
je 0x140013a7d
cmp eax, 1
je 0x140013a7d
cmp eax, 0x32
je 0x140013a7d
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
mov dword [0x14015e5b0], 1
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rsi, rax
mov qword [rsp + 0x30], rax
cmp dword [0x14015e5ac], 0
je 0x140013ab8
cmp dword [0x14015e5b0], 0
jne 0x140013ae6
mov ebx, edi
cmp rsi, 0xffffffffffffffff
sete bl
test ebx, ebx
je 0x140013acd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140013ae6
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x140013a62
Function at 0x140014320
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x14015a038]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r14, rdx
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x14001450f
lea rcx, [rsp + 0x70]
call fcn.1400da1c8
lea rdi, [rsp + 0x70]
movzx ebx, word [rsp + 0x70]
test bx, bx
je 0x14001450f
xor r15d, r15d
movabs r12, 0x38e38e38e38e38e
nop word [rax + rax]
cmp bx, 0x43
jb 0x1400144e5
movzx r8d, bx
lea rdx, [rsp + 0x50]
call fcn.140014ff0
nop
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x1400144a7
mov rsi, qword [r14]
mov rax, qword [rsi + 8]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], r15d
mov rcx, rsi
cmp byte [rax + 0x19], 0
jne 0x14001440b
mov qword [rsp + 0x20], rax
cmp word [rax + 0x20], bx
jae 0x1400143f7
mov dword [rsp + 0x28], r15d
mov rax, qword [rax + 0x10]
jmp 0x140014405
mov dword [rsp + 0x28], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400143e1
cmp byte [rcx + 0x19], 0
jne 0x140014417
cmp bx, word [rcx + 0x20]
jae 0x140014482
cmp qword [r14 + 8], r12
je 0x140014542
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
mov ecx, 0x48
call fcn.14009b4d4
nop
mov word [rax + 0x20], bx
mov qword [rax + 0x28], r15
mov qword [rax + 0x38], r15
mov qword [rax + 0x40], 7
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
mov qword [rsp + 0x48], r15
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov r8, rax
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140016ec0
mov rcx, rax
mov r8, qword [rsp + 0x60]
add rcx, 0x28
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x1400144a7
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
call fcn.1400123a0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400144e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400144e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014548
call fcn.14009b510
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rdi + rax*2], 0
jne 0x1400144f0
lea rdi, [rdi + rax*2]
add rdi, 2
movzx ebx, word [rdi]
test bx, bx
jne 0x1400143a0
cmp qword [r14 + 8], 0
setne al
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14009b5b0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140017bd0
nop
call fcn.1400ac408
int3
Function at 0x14001f1f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14015a038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
lea r8d, [rdi + 0x1c]
lea rdx, str.url.dll_FileProtocolHandler
lea rcx, [rsp + 0x30]
call fcn.1400123a0
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001f248
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000b610
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r9, qword [rsp + 0x30]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
lea r8, str.rundll32.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14001f2c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f2c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f2e1
call fcn.14009b510
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14009b5b0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.1400ac408
int3
Function at 0x1400212e0
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rbp
sub rsp, 0x38
mov rbx, r9
mov rbp, rcx
cmp r8, 0x27da
jne 0x140021422
test rbx, rbx
je 0x140021422
cmp dword [r9 + 0x10], 0x70b
jne 0x140021422
mov eax, dword [r9 + 0x18]
add eax, 0xfffffdff
test eax, 0xfffffffd
jne 0x140021422
mov qword [rsp + 0x50], rsi
mov edx, r8d
mov qword [rsp + 0x30], rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x58]
mov dword [rsp + 0x60], 0
mov rcx, rax
mov dword [rsp + 0x58], 0
lea r8, [rsp + 0x60]
mov edx, 0xb0
mov rsi, rax
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r9, dword [rbx + 0x30]
mov edx, 0xb1
movsxd r8, dword [rbx + 0x2c]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rbx + 0x30]
mov rcx, 0xffffffffffffffff
sub eax, dword [rbx + 0x2c]
lea ebx, [rax + 1]
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.14009bed8
lea r8, [rbx + rbx]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14009e4c0
mov r9, rdi
xor r8d, r8d
mov edx, 0x43e
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov r8, rdi
mov qword [rsp + 0x20], 0
lea rdx, str.open
mov rcx, rbp
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rdi
call fcn.14009b518
mov r9d, dword [rsp + 0x58]
mov edx, 0xb1
mov r8d, dword [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x50]
add rsp, 0x38
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x38
pop rbp
pop rbx
ret
Function at 0x1400265c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [0x14015e5f4], 0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [0x14015ae88]
mov qword [0x14015e658], rax
cmp rcx, rbx
je 0x140026602
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x1400265f9
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
call fcn.1400123a0
mov qword [rsp + 0x28], 0
lea r8, [0x140026590]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x30
pop rbx
ret

Function at 0x140026660
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x60
mov rax, qword [0x14015a038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call fcn.1400de26c
test eax, eax
jne 0x140026712
lea rdx, [0x140136230]
mov qword [rsp + 0x80], rdi
mov rcx, rbx
call fcn.1400af750
mov rdi, rax
test rax, rax
je 0x140026710
movsxd rbx, dword [rsp + 0x34]
mov rcx, rsi
mov rdx, rbx
call fcn.140019e80
test rbx, rbx
je 0x1400266e3
mov rcx, qword [rsi]
mov r9, rdi
mov r8, rbx
mov edx, 1
call fcn.1400de798
mov rdx, rax
mov rcx, rsi
call fcn.140019e80
mov rcx, rdi
call fcn.1400d8734
mov al, 1
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14009b5b0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rsi
ret
jmp 0x1400266ed
xor al, al
jmp 0x1400266f5

Function at 0x14002bef0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword [0x14015a038]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r9d, dword [0x14015eb94]
mov rbx, rdx
inc r9d
lea rdx, str._ld_ld
mov r8d, ecx
mov dword [0x14015eb94], r9d
lea rcx, [rsp + 0x20]
call fcn.14001e0a0
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbx - 2]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x14002bf45
lea r8, [rsp + 0x20]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14002bf60
sub rbx, 2
nop word [rax + rax]
cmp word [rbx + 2], 0
lea rbx, [rbx + 2]
jne 0x14002bf80
movsd xmm0, qword [str..dat]
movsd qword [rbx], xmm0
movzx eax, word [0x140136500]
mov word [rbx + 8], ax
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14009b5b0
add rsp, 0x230
pop rbx
ret
Function at 0x14002c310
Capabilities:
Check if file exists
Delete file
Get file attributes
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x258
mov rax, qword [0x14015a038]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r15, qword [rsp + 0x2b0]
xor ebx, ebx
mov rsi, r9
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test rdx, rdx
je 0x14002c435
test r8, r8
je 0x14002c435
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov edx, ebx
sete dl
je 0x14002c378
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, eax
test edx, edx
je 0x14002c435
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14002bef0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov ecx, ebx
sete cl
je 0x14002c3af
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, eax
test ecx, ecx
je 0x14002c41a
lea rdx, [0x1401361b8]
lea rcx, [rsp + 0x30]
call fcn.1400af750
mov rdi, rax
test rax, rax
je 0x14002c41a
mov r9, rax
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.1400d8a9c
mov rcx, rdi
call fcn.1400d8734
xor edx, edx
lea rcx, [rsp + 0x30]
mov r9, r15
lea r8d, [rdx + 2]
call fcn.14004e710
mov rdi, rax
test rax, rax
je 0x14002c41a
cmp dword [rax], 1
je 0x14002c457
mov eax, 0x80000
mov dword [0x14015eba4], eax
mov rcx, rdi
call fcn.140048380
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002c435
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14009b5b0
add rsp, 0x258
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rax + 8]
xor r9d, r9d
mov r8, rsi
mov dword [rsp + 0x20], 2
xor edx, edx
call fcn.14004df80
test eax, eax
mov dword [0x14015eba4], eax
sete bl
cmp dword [rdi], 1
jne 0x14002c412
mov rcx, rdi
call fcn.14004eca0
jmp 0x14002c41a
Function at 0x14002cd30
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rdx], rax
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], 7
mov word [rdx], ax
mov dword [rsp + 0x20], 1
mov rcx, qword [rcx + 0x60]
cmp rcx, 0xffffffffffffffff
jne 0x14002ce59
lea rsi, [rdi + 0x40]
cmp rsi, rdi
je 0x14002cd9f
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14002cd93
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
call fcn.1400123a0
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14002cdd2
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x14002cdb5
mov rax, qword [rsi]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x14002cdd2
mov r8d, 1
lea rdx, [0x14012e6c4]
mov rcx, rsi
call fcn.14000b610
lea rdx, [rdi + 0x20]
cmp qword [rdi + 0x38], 8
jb 0x14002cde1
mov rdx, qword [rdi + 0x20]
mov r8, qword [rdi + 0x30]
mov rcx, rsi
call fcn.14000b610
cmp qword [rsi + 0x18], 8
jb 0x14002cdf7
mov rsi, qword [rsi]
lea rdx, [rdi + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rdi + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x14002cee3
mov esi, 0x2e
cmp si, word [rdi + 0x94]
jne 0x14002ce67
lea rdx, [rdi + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14002cee3
cmp si, word [rdi + 0x94]
jne 0x14002cee3
lea rdx, [rdi + 0x68]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14002ce67
jmp 0x14002cee3
lea rdx, [rdi + 0x68]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14002cee3
cmp rbx, rdi
je 0x14002ce85
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14002ce79
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rbx
call fcn.1400123a0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14002ceb8
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002ce9b
mov rax, qword [rbx]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x14002ceb8
mov r8d, 1
lea rdx, [0x14012e6c4]
mov rcx, rbx
call fcn.14000b610
lea rdx, [rdi + 0x94]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14002ced0
mov rcx, rbx
call fcn.14000b610
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret