joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b38e0
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x14037b4f8]
test rcx, rcx
je 0x1401b3939
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x30], 0x103
jne 0x1401b3921
mov rcx, qword [0x14037b4f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
call fcn.140192ca0
mov rcx, qword [0x14037b4f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14037b4f8], 0
mov dword [0x14037b4f4], 0
add rsp, 0x28
ret
Function at 0x1401c07b0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0x98
lea rcx, [rsp + 0x54]
mov ebx, r9d
call fcn.140249b10
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x54], 5
jne 0x1401c0816
cmp dword [rsp + 0x58], 0
jne 0x1401c0816
cmp dword [rsp + 0x120], 0xffffffff
cmovne ebx, dword [rsp + 0x120]
mov eax, dword [rsp + 0x130]
mov r8d, 1
mov r9d, dword [rsp + 0x128]
mov rcx, rdi
movzx edx, bx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_LoadImageA]
test rax, rax
je 0x1401c0897
mov ecx, dword [rsp + 0x158]
mov r8, rax
mov r9, qword [rsp + 0x138]
mov rdx, rsi
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], ecx
mov ecx, dword [rsp + 0x150]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x148]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x140]
mov dword [rsp + 0x20], ecx
mov rcx, rbp
call fcn.1401aa8a0
mov eax, 1
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1401d4680
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rcx, qword [rcx + 8]
mov edi, r9d
mov rsi, r8
mov rax, qword [rcx]
cmp rax, rcx
je 0x1401d46b5
mov rbx, qword [rax + 0x10]
cmp qword [rbx], rdx
je 0x1401d46cc
mov rax, qword [rax]
cmp rax, rcx
jne 0x1401d46a4
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
test rbx, rbx
je 0x1401d46b5
mov rcx, qword [rbx + 0x48]
mov qword [rsp + 0xe0], rbp
xor ebp, ebp
test rcx, rcx
je 0x1401d46f2
call qword [sym.imp.USER32.dll_DestroyIcon]
mov qword [rbx + 0x48], rbp
mov qword [rbx + 0x50], rbp
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0x98
call fcn.140249b10
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x34], 5
jne 0x1401d4734
cmp dword [rsp + 0x38], ebp
jne 0x1401d4734
cmp dword [rsp + 0x100], 0xffffffff
cmovne edi, dword [rsp + 0x100]
mov eax, dword [rsp + 0x110]
mov r8d, 1
mov r9d, dword [rsp + 0x108]
mov rcx, rsi
movzx edx, di
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_LoadImageA]
mov rbp, qword [rsp + 0xe0]
mov qword [rbx + 0x48], rax
test rax, rax
je 0x1401d46b5
mov rcx, rbx
call fcn.1401d4b20
mov eax, 1
jmp 0x1401d46b7
Function at 0x1401d7050
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
lea r9, str.TOASTER
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
mov qword [rsp + 0x28], 0
lea r8, [0x1401d9ef0]
mov qword [0x14037c820], rax
mov edx, 0x10000
mov dword [rsp + 0x20], 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x1401d83d0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0xa8
mov rdx, rcx
mov rcx, qword [0x14037c8c0]
test rcx, rcx
je 0x1401d8558
mov eax, dword [reloc.OLEAUT32.dll_SysStringLen]
lea r9, [0x1401d7970]
mov byte [rsp + 0x50], 1
xor r8d, r8d
mov qword [rsp + 0x48], r8
inc eax
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r8d
mov r8d, 0x92d
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov rdx, qword [0x14034e658]
mov dword [reloc.OLEAUT32.dll_SysStringLen], eax
call fcn.1401d6480
mov r8d, dword [reloc.OLEAUT32.dll_SysStringLen]
lea r9, [rsp + 0x75]
test r8d, r8d
jns 0x1401d8490
neg r8d
nop dword [rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x1401d8450
dec r9
mov byte [r9], 0x2d
jmp 0x1401d84ba
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x1401d8490
movdqa xmm0, xmmword [0x14029c3d0]
lea rax, [rsp + 0x75]
mov byte [rsp + 0x78], 0
movdqu xmmword [rsp + 0x88], xmm0
cmp r9, rax
je 0x1401d84ef
lea r8, [rsp + 0x75]
mov rdx, r9
sub r8, r9
lea rcx, [rsp + 0x78]
call fcn.1400b29c0
cmp qword [rsp + 0x90], 0x10
lea rcx, [rsp + 0x78]
cmovae rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x90]
cmp rdx, 0x10
jb 0x1401d8545
mov rcx, qword [rsp + 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401d8540
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401d8560
call fcn.140247060
lea rcx, reloc.OLEAUT32.dll_VariantCopyInd
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
inc dword [0x14037c860]
add rsp, 0xa8
ret
call fcn.1402500e8
int3
Function at 0x1401d85a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1401d8654
cmp byte [rcx + 0x72], 0
je 0x1401d8654
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp di, ax
je 0x1401d8604
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1401d8611
sub eax, 1
je 0x1401d8615
sub eax, 2
je 0x1401d8654
xor al, al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1401d8642
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call fcn.140252b10
cmp rdi, rax
jne 0x1401d8604
cmp byte [rbx + 0x72], 0
sete al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x68]
mov al, 1
add rsp, 0x50
pop rdi
ret

Function at 0x1401d93c0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x1401d93e2
xor eax, eax
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1401d9424
mov r8, qword [rcx + 0x58]
movsxd r9, dword [r8]
mov rax, r9
lea rcx, [rdx + r9*2]
cmp rdx, rcx
jae 0x1401d9424
lea eax, [r9 - 1]
mov dword [r8], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
movzx eax, si
mov word [rdx], si
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x90], rbp
je 0x1401d9536
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1401d946b
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1401d9494
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140258e24
cmp ax, di
je 0x1401d9536
movzx edi, si
jmp 0x1401d9536
lea r8, [rsp + 0xa0]
mov word [rsp + 0x40], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x42]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0xa8]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
js 0x1401d9536
cmp eax, 1
jle 0x1401d94f0
cmp eax, 3
jne 0x1401d9536
movzx ecx, word [rsp + 0x40]
jmp 0x1401d9477
mov rbp, qword [rsp + 0xa0]
lea rax, [rsp + 0x48]
sub rbp, rax
je 0x1401d9520
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rbp
mov edx, 1
call fcn.140252b10
cmp rbp, rax
jne 0x1401d9536
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0xa8], rax
movzx eax, si
jne 0x1401d9539
movzx eax, di
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401de4a0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rcx
cmp qword [0x14037c8c0], 0
je 0x1401de555
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.14018ef40
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1401de521
lea rax, vtable.CSABString.0
mov qword [rbx], rax
mov qword [rbx + 8], 0
mov dword [rbx + 0x10], 0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbx + 8], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbx + 0x14], 1
mov rdx, rdi
mov rcx, rbx
call fcn.140004820
nop
jmp 0x1401de523
xor ebx, ebx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, rbx
lea r8, [0x1401de560]
mov edx, 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1401ff1b0
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x398]
sub rsp, 0x480
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov r14d, edx
mov rdi, rcx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], 0
jne 0x1401ff1e3
cmp r8, 3
jb 0x1401ff379
movzx edx, byte [rcx]
lea ecx, [rdx - 0x61]
cmp cl, 0x19
jbe 0x1401ff20e
sub dl, 0x41
cmp dl, 0x19
ja 0x1401ff379
cmp byte [rdi + 1], 0x3a
jne 0x1401ff379
cmp byte [rdi + 2], 0x5c
jne 0x1401ff379
xor eax, eax
mov dword [rsp + 0x48], eax
lea r9d, [rax + 3]
mov r8, rdi
lea edx, [rax + 4]
lea rcx, [rsp + 0x48]
call fcn.140250550
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x1401ff379
xor esi, esi
mov qword [rsp + 0x40], rsi
mov dword [rbp + 0x3b0], esi
mov dword [rbp + 0x3b8], esi
mov qword [rsp + 0x30], rsi
lea rax, [rbp + 0x3b8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call sub.NETAPI32.dll_NetUseEnum
mov ecx, esi
mov r9d, dword [rbp + 0x3b0]
test r9d, r9d
je 0x1401ff368
mov r8, qword [rsp + 0x40]
movzx eax, byte [rsp + 0x48]
mov ebx, ecx
shl rbx, 4
mov rdx, qword [rbx + r8]
cmp al, byte [rdx]
je 0x1401ff2d4
inc ecx
cmp ecx, r9d
jb 0x1401ff2b0
mov rcx, r8
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, esi
jmp 0x1401ff37e
lea rax, vtable.CSABString.0
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x60], esi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x58], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rsp + 0x64], 1
mov rdx, qword [rsp + 0x40]
add rdx, 8
add rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140005530
mov rbx, qword [rsp + 0x58]
mov r8, rbx
mov edx, 0x410
lea rcx, [rsp + 0x70]
call fcn.140253604
lea rdx, [rdi + 3]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rdx, r14
lea r8, [rsp + 0x70]
mov rcx, rdi
call fcn.140253604
mov esi, 1
cmp dword [rsp + 0x64], esi
jne 0x1401ff368
test rbx, rbx
je 0x1401ff368
mov rcx, rbx
call fcn.140247060
mov r8, qword [rsp + 0x40]
mov rcx, r8
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, esi
jmp 0x1401ff37e
mov eax, 1
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14021f190
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x488]
sub rsp, 0x580
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
xor edx, edx
mov r8d, SysAllocStringByteLen
lea rcx, [rbp - 0x30]
call fcn.140249b10
lea rsi, vtable.CSABString.0
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x30], 0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov dword [rsp + 0x34], 1
mov dword [rbp - 0x30], SysAllocStringByteLen
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rbp - 0x20], 2
jne 0x14021f3a3
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x60]
call fcn.140249b10
cmp dword [rbp - 0x2c], 5
jne 0x14021f23e
cmp dword [rbp - 0x28], 2
jb 0x14021f3a3
mov edx, 0x410
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathStripToRootA]
lea rdx, str.System_Volume_Information
lea rcx, [rbp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rcx, [rbp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesA]
test rdi, rdi
je 0x14021f288
mov rcx, rdi
call fcn.140247060
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0x70]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14021f293
mov dword [rsp + 0x30], ebx
lea eax, [rbx + 1]
mov edi, eax
mov ecx, eax
call fcn.140247068
mov r14, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14021f2c8
mov r8d, edi
lea rdx, [rbp + 0x70]
mov rcx, rax
call fcn.1402496a0
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x48], SafeArrayGetDim
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14021f2f6
movups xmm0, xmmword [str.__E__R_everyone]
movups xmmword [rax], xmm0
mov dword [rsp + 0x4c], 1
lea ecx, [rbx + 0x10]
call fcn.140247068
mov rdi, rax
test r14, r14
je 0x14021f336
mov rcx, r14
mov rdx, rax
sub rdx, r14
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14021f320
mov rcx, r14
call fcn.140247060
test rdi, rdi
je 0x14021f344
mov eax, ebx
movups xmm0, xmmword [rsi]
movups xmmword [rax + rdi], xmm0
test rsi, rsi
je 0x14021f351
mov rcx, rsi
call fcn.140247060
mov dword [rsp + 0x60], WSACleanup
lea rax, str.cacls.exe
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rdi
lea rax, [0x140299514]
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x70], 0
mov dword [rsp + 0x64], 0x440
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x14021f3a3
mov edx, 0x2710
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
test rdi, rdi
je 0x14021f3b0
mov rcx, rdi
call fcn.140247060
mov eax, 1
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140222510
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x150
mov qword [rsp + 0x30], 0xfffffffffffffffe
lea rdx, [rsp + 0x180]
call qword [sym.imp.RPCRT4.dll_UuidToStringA]
mov r9, qword [rsp + 0x180]
mov r8, qword [str.SUPERAntiSpyware_Scheduled_Task__s]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14000b150
lea rax, vtable.CTaskScheduler.0
mov qword [rsp + 0x188], rax
lea rax, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
mov rbx, rcx
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140222570
inc rbx
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140247068
mov rdi, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
cmp eax, 1
ja 0x140222660
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, [0x1402c2e20]
mov esi, 1
mov r8d, esi
xor edx, edx
lea rcx, [0x1402c2e40]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14022265a
mov qword [rsp + 0x178], rbx
mov rcx, qword [rsp + 0x170]
mov rax, qword [rcx]
lea r9, [rsp + 0x178]
lea r8, [0x1402c2e10]
mov rdx, rdi
call qword [rax + 0x30]
cmp eax, 0x80070002
jne 0x140222623
mov ebx, esi
jmp 0x14022264b
test eax, eax
js 0x140222635
mov rcx, qword [rsp + 0x178]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x170]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x38]
test eax, eax
cmovns ebx, esi
mov rcx, qword [rsp + 0x170]
mov r8, qword [rcx]
call qword [r8 + reloc.OLEAUT32.dll_SafeArrayGetDim]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov edx, 2
mov rcx, rdi
call fcn.140247060
nop
mov eax, ebx
add rsp, 0x150
pop rdi
pop rsi
pop rbx
ret
Function at 0x140222ff0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
xor ebx, ebx
mov edi, edx
xor ecx, ecx
mov esi, ebx
mov r14, r8
call qword [sym.imp.ole32.dll_CoInitialize]
cmp eax, 1
ja 0x14022314e
lea rax, [rsp + 0x40]
xor edx, edx
lea r9, [0x1402c2e20]
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 1]
lea rcx, [0x1402c2e40]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140223148
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
js 0x14022313d
mov rcx, qword [rsp + 0x38]
lea edx, [rdi + 1]
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x78]
mov dword [rsp + 0x78], ebx
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
js 0x140223132
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140223132
mov eax, dword [rsp + 0x78]
cmp eax, edi
jbe 0x140223105
lea rsi, [rdi*8]
mov rcx, 0xffffffffffffffff
mov rax, qword [rsi + rdx]
mov rdi, rcx
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], bx
jne 0x1402230c0
inc rdi
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.140247068
mov r8, qword [rsp + 0x30]
mov rdx, rdi
mov qword [r14], rax
mov rcx, rax
mov r8, qword [rsi + r8]
call fcn.140251ec0
mov rdx, qword [rsp + 0x30]
mov esi, 1
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x140223129
nop dword [rax]
mov ecx, ebx
mov rcx, qword [rdx + rcx*8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rsp + 0x30]
inc ebx
cmp ebx, dword [rsp + 0x78]
jb 0x140223110
mov rcx, rdx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x140226360
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x250
mov rsi, r8
lea r9, [0x140286ae1]
mov r8, qword [str.SUPERAntiSpyware_Scheduled_Task__s]
lea rcx, [rsp + 0x30]
mov rbp, rdx
mov edx, 0x104
call fcn.14000b150
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x30]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1402263a4
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140250b10
test eax, eax
jne 0x1402264ac
mov qword [rsp + 0x260], rdi
lea rax, [rsp + 0x30]
xor edi, edi
inc rbx
cmp byte [rax + rbx], dil
jne 0x1402263d2
add rbx, rsi
lea rdx, str..job
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x1402263f6
mov byte [rax], dil
mov r9, rbx
lea r8, str.SELECT_id_FROM_ScheduledTasks_WHERE_taskid_LIKE__s
mov edx, 0x104
lea rcx, [rsp + 0x140]
call fcn.14000b150
lea rcx, [rbp + 0x40]
mov esi, edi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140226441
mov rax, qword [rcx]
lea r8, [rsp + 0x278]
xor r9d, r9d
lea rdx, [rsp + 0x140]
call qword [rax]
mov esi, eax
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x1402264a0
mov rcx, qword [rsp + 0x278]
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rsi, qword [rsp + 0x278]
mov ecx, 1
test eax, eax
cmovne edi, ecx
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140226496
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov rdi, qword [rsp + 0x260]
jmp 0x1402264b1
mov eax, 1
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x14022fd40
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [0x14037edc0], 0
mov rbx, rcx
jne 0x14022fd6d
mov ecx, 0x28
call fcn.14018ef40
mov rcx, rax
mov qword [0x14037edc0], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x14037adb0]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0xa8]
cmp eax, 0xffffffff
je 0x14022ff67
test al, 0x10
jne 0x14022ff67
mov qword [rsp + 0x50], rsi
mov rcx, rbx
mov qword [rsp + 0x60], rdi
call fcn.14022ff80
mov qword [rsp + 0x58], rax
mov rsi, rax
test rax, rax
je 0x14022feda
mov rbx, qword [0x14037cae0]
mov edi, dword [0x14033ce10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14022fdf7
mov edx, SafeArrayGetDim
mov rcx, rbx
call fcn.1400dda20
test rax, rax
je 0x14022fdf7
mov edx, edi
mov rcx, rax
call fcn.140191b00
xor edi, edi
test rax, rax
je 0x14022fdf9
mov rbx, qword [rax + 8]
jmp 0x14022fdfc
xor edi, edi
mov rbx, rdi
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14022fe1d
mov r9, rsi
xor r8d, r8d
mov edx, 0x8000
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x14037edc0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14037edd0]
lea r9, [rsp + 0x58]
mov rdx, rbx
lea rcx, [0x14037edd0]
mov rsi, qword [rbx + 8]
mov r8, rsi
call fcn.140009370
mov rdx, qword [0x14037edd8]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rdx
cmp rcx, 1
jb 0x14022ff6d
inc rdx
mov qword [0x14037edd8], rdx
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [0x14037edc0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x14037edc8], 0
jne 0x14022ff5d
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x14022fb60]
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov dword [0x14037edc8], 1
add rsp, 0x40
pop rbx
ret
mov rcx, qword [0x14037edb8]
xor edi, edi
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov r8d, 0x200
mov qword [rsp + 0x20], rdi
lea edx, [rdi - 1]
call fcn.140062180
mov rcx, qword [0x14037edb8]
mov r9, rbx
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dword [rsp + 0x28], 0x401
mov rdx, rax
mov dword [rsp + 0x20], 0x460102
call fcn.1400625b0
mov rcx, qword [0x14037edb8]
lea r8d, [rdi + 0x18]
xor r9d, r9d
mov dword [rsp + 0x20], edi
mov rdx, rax
mov rbx, rax
call fcn.140066e70
mov rcx, qword [0x14037edb8]
lea r8, str._SENT_
xor r9d, r9d
mov rdx, rbx
call fcn.140067480
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbx
ret
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3