joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015960
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2c0
mov r8d, 1
lea rdx, [0x140255008]
lea rcx, [0x140259870]
call fcn.140015ea0
test rax, rax
jne 0x140015992
xor eax, eax
jmp 0x140015c65
call fcn.140015d40
call fcn.140062440
ucomisd xmm0, qword [0x1401a9d50]
jp 0x1400159ac
je 0x140015ba9
call fcn.140016520
cmp eax, 4
je 0x140015b85
call fcn.140016520
mov ecx, eax
call fcn.1400164a0
cmp eax, 0xffffffff
je 0x140015b77
lea rdx, [0x1401a951c]
lea rcx, [rsp + 0x68]
call fcn.1400068e0
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x248], rax
mov rdx, qword [rsp + 0x248]
lea rcx, [rsp + 0x30]
call fcn.1400446f0
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x258], rax
lea rcx, [0x140259870]
call fcn.1400078b0
mov rdx, qword [rsp + 0x258]
mov rcx, rax
call fcn.14000a240
nop
lea rcx, [rsp + 0x30]
call fcn.140006ba0
nop
lea rcx, [rsp + 0x68]
call fcn.140006c00
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0x2d0]
call fcn.140015c80
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x268], rax
mov edx, WSAStartup
mov rcx, qword [rsp + 0x268]
call fcn.1400045f0
cmp eax, 1
jne 0x140015aa5
mov dword [rsp + 0x270], 1
jmp 0x140015ab0
mov dword [rsp + 0x270], 0
movzx eax, byte [rsp + 0x270]
mov byte [rsp + 0xc0], al
lea rcx, [rsp + 0xc8]
call fcn.140006ba0
movzx eax, byte [rsp + 0xc0]
test eax, eax
je 0x140015b75
lea rdx, [0x1401a9548]
lea rcx, [rsp + 0x138]
call fcn.1400068e0
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x280], rax
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0x100]
call fcn.1400446f0
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x290], rax
lea rcx, [0x140259870]
call fcn.1400078b0
mov rdx, qword [rsp + 0x290]
mov rcx, rax
call fcn.14000a240
nop
lea rcx, [rsp + 0x100]
call fcn.140006ba0
nop
lea rcx, [rsp + 0x138]
call fcn.140006c00
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x140015b83
call fcn.140016520
mov ecx, eax
call fcn.140016420
jmp 0x140015ba4
lea rax, str.system
mov qword [rsp + 0x20], rax
lea r9, [0x1401a9614]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14003de30
jmp 0x140015c60
lea rdx, [0x1401a9638]
lea rcx, [rsp + 0x190]
call fcn.1400068e0
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x2a0], rax
mov rcx, qword [rsp + 0x2a0]
call fcn.140006db0
mov qword [rsp + 0x2a8], rax
lea rdx, str.error_system_time
lea rcx, [rsp + 0x1e8]
call fcn.1400068e0
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x2b8], rax
mov rcx, qword [rsp + 0x2b8]
call fcn.140006db0
xor r9d, r9d
mov rcx, qword [rsp + 0x2a8]
mov r8, rcx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rcx, [rsp + 0x1e8]
call fcn.140006c00
nop
lea rcx, [rsp + 0x190]
call fcn.140006c00
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
add rsp, 0x2c0
pop rdi
ret
Function at 0x140015f70
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x30]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x34]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1401aa010]
call fcn.1400bfbe0
mov eax, edi
add rsp, 0x50
pop rdi
ret

Function at 0x140016420
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x40
cmp dword [rsp + 0x50], 0
jne 0x14001643c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x20], eax
jmp 0x140016444
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140016473
mov byte [rsp + 0x31], 1
jmp 0x140016478
mov byte [rsp + 0x31], 0
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x14001a750
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x160
lea rdi, [rsp + 0x30]
mov ecx, 0x4c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x170]
cmp qword [rsp + 0x170], 0
je 0x14001a79d
mov rax, qword [rsp + 0x170]
jmp 0x14001a930
lea rcx, [rsp + 0x40]
call fcn.140006a00
nop
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cdqe
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x14001a7d4
lea rdx, [0x1401ae210]
lea rcx, [rsp + 0x40]
call fcn.140052e80
lea rcx, [rsp + 0xb8]
call fcn.140044680
nop
lea rcx, [rsp + 0x108]
call fcn.140044680
nop
xor r8d, r8d
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0x178]
call fcn.140034e50
mov qword [rsp + 0x158], rax
xor r8d, r8d
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x180]
call fcn.140034e50
mov rcx, qword [rsp + 0x158]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x188]
mov r8, rax
lea rdx, [0x1401ae218]
lea rcx, [rsp + 0x40]
call fcn.1400539e0
mov rcx, qword [rsp + 0x190]
call fcn.14001a950
test rax, rax
jne 0x14001a886
lea rdx, [0x1401ae24c]
lea rcx, [rsp + 0x40]
call fcn.140052e80
mov rdx, qword [rsp + 0x190]
lea rcx, [rsp + 0x40]
call fcn.140052e80
lea rcx, [rsp + 0x40]
call fcn.140052570
mov qword [rsp + 0x148], rax
cmp qword [rsp + 0xa8], 0
je 0x14001a8b4
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
int3
mov r9d, SafeArrayLock
lea r8, [0x1401ae258]
mov rdx, qword [rsp + 0x148]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
test eax, eax
jne 0x14001a8f2
mov r8d, 0x41
lea rdx, str.D:HSwin_androidplugins_vprj_winclasslib_sys_baselibswin_basecpp_vol_assert.cpp
lea rcx, [0x1401ae330]
call fcn.140126ae0
xor eax, eax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x108]
call fcn.140006ba0
nop
lea rcx, [rsp + 0xb8]
call fcn.140006ba0
nop
lea rcx, [rsp + 0x40]
call fcn.140006c20
mov rax, qword [rsp + 0x150]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401b0450]
call fcn.1400bfbe0
mov rax, rdi
add rsp, 0x160
pop rdi
ret
Function at 0x1400218e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
cmp qword [rsp + 0x70], 0
je 0x140021949
cmp qword [rsp + 0x58], 0
je 0x140021949
cmp qword [rsp + 0x60], 0
jl 0x140021949
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x1f8], 0
jne 0x140021949
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xa0], 0
jne 0x140021949
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xa8], 0
jne 0x140021949
mov qword [rsp + 0x20], 1
jmp 0x140021952
mov qword [rsp + 0x20], 0
mov r9d, GetAltMonthNames
lea r8, [0x1401b3f60]
lea rdx, str.pVolAppRuntimeClass___NULL__hInstance___NULL__npArgC___0__m_hInstance__NULL__m_pVolAppObject__NULL__m_blpComInitSucceeded__FALSE
mov rcx, qword [rsp + 0x20]
call fcn.14001a700
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x1f8], rcx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x200], rcx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x208], rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x210], eax
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x1400219d0
mov qword [rsp + 0x28], 1
jmp 0x1400219d9
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0xa8], rcx
mov ecx, 2
call fcn.14003a5f0
xor ecx, ecx
call fcn.14003a470
mov rax, qword [rsp + 0x50]
movsd qword [rax + 0xb0], xmm0
mov rcx, qword [rsp + 0x70]
call fcn.140019b50
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0xa0], rax
call fcn.140012360
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xa0]
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + 0xa0]
mov qword [rsp + 0x30], rdx
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov rdx, rax
mov rax, qword [rsp + 0x30]
mov rcx, rax
mov rax, qword [rsp + 0x38]
call qword [rax + 0x68]
test eax, eax
jne 0x140021aa2
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0xa0]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rax]
call qword [rax + 0x60]
mov r9d, 0x15d
lea r8, [0x1401b4080]
lea rdx, [0x1401b3d38]
xor ecx, ecx
call fcn.14001a700
mov ecx, 0xffffffff
call fcn.140122e90
add rsp, 0x40
pop rdi
ret
Function at 0x140022060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
lea rdi, [rsp + 0x20]
mov ecx, SafeArrayAllocDescriptor
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
cmp dword [rsp + 0xb8], 0
jl 0x1400220b1
cmp dword [rsp + 0xb8], 4
jge 0x1400220b1
mov qword [rsp + 0x90], 1
jmp 0x1400220bd
mov qword [rsp + 0x90], 0
mov r9d, 0x244
lea r8, [0x1401b4610]
lea rdx, str.enImageType___0__enImageType____NUM_VOL_RES_IMAGE_TYPES
mov rcx, qword [rsp + 0x90]
call fcn.14001a700
cmp qword [rsp + 0xc0], 0
je 0x140022275
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xb0]
call qword [rax]
mov qword [rsp + 0x20], rax
cmp dword [rsp + 0xb8], 0
je 0x14002211f
cmp dword [rsp + 0xb8], 3
jne 0x140022223
movzx eax, word [rsp + 0xc0]
mov r8d, 0xa
mov edx, eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140022221
mov qword [rsp + 0x30], 0
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400221e1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1400221d6
lea rcx, [rsp + 0x58]
call fcn.140023460
nop
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov r8d, eax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.14001be10
test rax, rax
je 0x1400221cc
lea rcx, [rsp + 0x58]
call fcn.14001e040
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x58]
call fcn.14001bbc0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp qword [rsp + 0x30], 0
je 0x140022221
cmp dword [rsp + 0xb8], 3
jne 0x14002221a
mov rcx, qword [rsp + 0x30]
call fcn.140022f20
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, qword [rsp + 0x88]
jmp 0x140022277
mov rax, qword [rsp + 0x30]
jmp 0x140022277
jmp 0x140022275
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 1
je 0x140022247
cmp dword [rsp + 0x98], 2
je 0x14002225e
jmp 0x140022275
movzx eax, word [rsp + 0xc0]
mov edx, eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x140022277
movzx eax, word [rsp + 0xc0]
mov edx, eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x140022277
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401b7b90]
call fcn.1400bfbe0
mov rax, rdi
add rsp, 0xa0
pop rdi
ret
Function at 0x140022660
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rcx, qword [rsp + 0x70]
call fcn.140007650
cmp qword [rsp + 0x68], 0
jne 0x140022695
mov eax, 1
jmp 0x140022756
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x60]
call qword [rax]
mov qword [rsp + 0x28], rax
movzx eax, word [rsp + 0x68]
mov r8, qword [rsp + 0x78]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400226d8
jmp 0x140022751
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400226f7
jmp 0x140022751
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14002273c
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov r8d, eax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call fcn.140023d90
mov qword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
test eax, eax
jne 0x14002269e
mov rax, qword [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x140037f30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
cmp qword [rsp + 0x48], 0
jle 0x140037f52
mov qword [rsp + 0x20], 1
jmp 0x140037f5b
mov qword [rsp + 0x20], 0
mov r9d, 0x9a3
lea r8, [0x1401c4c10]
lea rdx, str.npBufLength___0
mov rcx, qword [rsp + 0x20]
call fcn.14001a700
mov rax, qword [rsp + 0x48]
shl rax, 1
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call fcn.140031e60
mov r9d, 0x9a4
lea r8, [0x1401c4c80]
lea rdx, str.IsValidAddress___psBuf____npBufLength__sizeof__TCHAR____TRUE_
mov rcx, rax
call fcn.14001a700
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jbe 0x140037fce
mov qword [rsp + 0x28], 1
jmp 0x140037fd7
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x28]
add rsp, 0x30
pop rdi
ret

Function at 0x140037ff0
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rcx, qword [rsp + 0x30]
call fcn.140007e50
mov r9d, 0x9b6
lea r8, [0x1401c4d20]
lea rdx, str.IsValidString__szNewDir_
mov rcx, rax
call fcn.14001a700
mov rcx, qword [rsp + 0x30]
call fcn.14001a950
test rax, rax
je 0x140038033
xor eax, eax
jmp 0x140038040
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cdqe
add rsp, 0x20
pop rdi
ret

Function at 0x140038590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
lea rdi, [rsp + 0x20]
mov ecx, 0x24
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc0]
call fcn.140007e50
mov r9d, 0x71a
lea r8, [0x1401c3690]
lea rdx, [0x1401c36f0]
mov rcx, rax
call fcn.14001a700
mov rcx, qword [rsp + 0xc0]
call fcn.14001a950
test rax, rax
je 0x1400385f5
xor eax, eax
jmp 0x14003865c
lea rcx, [rsp + 0x30]
call fcn.140006a00
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
call fcn.140038680
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14003862e
mov qword [rsp + 0xa0], 1
jmp 0x14003863a
mov qword [rsp + 0xa0], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x30]
call fcn.140006c20
mov rax, qword [rsp + 0x98]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401ca288]
call fcn.1400bfbe0
mov rax, rdi
add rsp, 0xb0
pop rdi
ret
Function at 0x140038c20
Capabilities:
Copy file

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rcx, qword [rsp + 0x40]
call fcn.14001a950
test rax, rax
jne 0x140038c52
mov rcx, qword [rsp + 0x48]
call fcn.14001a950
test rax, rax
je 0x140038c59
xor eax, eax
jmp 0x140038d50
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 1
je 0x140038c78
cmp dword [rsp + 0x24], 2
je 0x140038c9b
cmp dword [rsp + 0x24], 3
je 0x140038c91
jmp 0x140038cb9
mov rcx, qword [rsp + 0x48]
call fcn.140038590
test rax, rax
je 0x140038c91
mov eax, 1
jmp 0x140038d50
mov dword [rsp + 0x20], 1
jmp 0x140038d01
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.140038b20
test rax, rax
je 0x140038cb9
mov eax, 1
jmp 0x140038d50
cmp dword [rsp + 0x50], 0
je 0x140038cd2
cmp dword [rsp + 0x50], 2
je 0x140038cd2
mov qword [rsp + 0x28], 0
jmp 0x140038cdb
mov qword [rsp + 0x28], 1
mov r9d, 0x6d9
lea r8, [0x1401c3460]
lea rdx, str.enOverrideMode__FCOM_OVERRIDE__enOverrideMode__FCOM_FAST
mov rcx, qword [rsp + 0x28]
call fcn.14001a700
mov dword [rsp + 0x20], 0
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.140127030
test eax, eax
jne 0x140038d39
mov rcx, qword [rsp + 0x40]
call fcn.140038590
test rax, rax
jne 0x140038d32
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140038d50
mov eax, 1
jmp 0x140038d50
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cdqe
add rsp, 0x30
pop rdi
ret
Function at 0x140039da0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
lea rdi, [rsp + 0x50]
mov ecx, 0x48
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
call fcn.140007e50
mov r9d, 0x87a
lea r8, [0x1401c43f0]
lea rdx, str.IsValidString__szCommandLine_
mov rcx, rax
call fcn.14001a700
mov rcx, qword [rsp + 0x180]
call fcn.14001a950
test rax, rax
je 0x140039e12
xor eax, eax
jmp 0x140039f69
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1400c2ab0
mov dword [rsp + 0x60], 0x68
cmp qword [rsp + 0x190], 0
jl 0x140039e58
mov eax, dword [rsp + 0x9c]
or eax, 1
mov dword [rsp + 0x9c], eax
movzx eax, word [rsp + 0x190]
mov word [rsp + 0xa0], ax
lea rcx, [rsp + 0x118]
call fcn.140044680
nop
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x118]
call fcn.140045f90
lea rcx, [rsp + 0x118]
call fcn.140007760
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140039ef9
mov qword [rsp + 0x158], 0
lea rcx, [rsp + 0x118]
call fcn.140006ba0
mov rax, qword [rsp + 0x158]
jmp 0x140039f69
cmp qword [rsp + 0x188], 0
je 0x140039f19
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140039f2c
mov edx, 0x1f4
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x160], 1
lea rcx, [rsp + 0x118]
call fcn.140006ba0
mov rax, qword [rsp + 0x160]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401ca870]
call fcn.1400bfbe0
mov rax, rdi
add rsp, 0x170
pop rdi
ret
Function at 0x14003a250
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rcx, qword [rsp + 0x180]
call fcn.140007e50
mov r9d, 0x8ae
lea r8, [0x1401c4590]
lea rdx, [0x1401c45f0]
mov rcx, rax
call fcn.14001a700
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.1400069b0
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x140], rax
mov r8, qword [rsp + 0x140]
lea rdx, str.__select___
lea rcx, [rsp + 0x88]
call fcn.140058a00
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x150], rax
lea r8, [0x1401c1434]
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0xe0]
call fcn.1400588c0
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x160], rax
mov rcx, qword [rsp + 0x160]
call fcn.140052570
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, str.explorer.exe
lea rdx, [0x1401c4630]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0xe0]
call fcn.140006c20
nop
lea rcx, [rsp + 0x88]
call fcn.140006c20
nop
lea rcx, [rsp + 0x30]
call fcn.140006c20
add rsp, 0x170
pop rdi
ret

Function at 0x14003a790
Capabilities:
Get system information on windows

Disassembly:
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1401caaf0]
call fcn.1400bfbe0
mov eax, edi
add rsp, 0x70
pop rdi
ret
Function at 0x14003bd80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x30]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
call fcn.140007e50
mov r9d, 0xa1e
lea r8, [0x1401c50c0]
lea rdx, [0x1401c5120]
mov rcx, rax
call fcn.14001a700
mov rcx, qword [rsp + 0xa8]
call fcn.140007e50
mov r9d, 0xa1f
lea r8, [0x1401c5140]
lea rdx, [0x1401c50a8]
mov rcx, rax
call fcn.14001a700
mov edx, 1
mov rcx, qword [rsp + 0xb0]
call fcn.1400420c0
mov r9d, 0xa20
lea r8, [0x1401c51a0]
lea rdx, [0x1401c5200]
mov rcx, rax
call fcn.14001a700
mov rcx, qword [rsp + 0xa0]
call fcn.14001a950
test rax, rax
jne 0x14003be5f
mov rcx, qword [rsp + 0xa8]
call fcn.14001a950
test rax, rax
jne 0x14003be5f
mov qword [rsp + 0x78], 1
jmp 0x14003be68
mov qword [rsp + 0x78], 0
mov r9d, 0xa21
lea r8, [0x1401c5240]
lea rdx, [0x1401c52a0]
mov rcx, qword [rsp + 0x78]
call fcn.14001a700
mov rcx, qword [rsp + 0xb0]
call fcn.140007650
mov rcx, qword [rsp + 0xa0]
call fcn.1400413a0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14003beb4
xor eax, eax
jmp 0x14003bfa8
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
jne 0x14003bf74
cmp dword [rsp + 0x44], 3
jne 0x14003bf06
mov qword [rsp + 0x80], 1
jmp 0x14003bf12
mov qword [rsp + 0x80], 0
mov r9d, 0xa2d
lea r8, [0x1401c5320]
lea rdx, str.dwType__REG_BINARY
mov rcx, qword [rsp + 0x80]
call fcn.14001a700
mov eax, dword [rsp + 0x64]
mov edx, eax
mov rcx, qword [rsp + 0xb0]
call fcn.140044d20
lea rcx, [rsp + 0x64]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x74], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x74], 0
jne 0x14003bf94
mov qword [rsp + 0x88], 1
jmp 0x14003bfa0
mov qword [rsp + 0x88], 0
mov rax, qword [rsp + 0x88]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1400bfbe0
mov rax, rdi
add rsp, 0x90
pop rdi
ret