joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e3dd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x006605b4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x5e3f78
mov rax, qword [0x006605b8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x5e3e1c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x5e3ea7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x5e3e00
mov rcx, r12
call fcn.005e4b30
mov rbp, rax
test rax, rax
je 0x5e3fb2
mov rax, qword [0x006605b8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.005e4c60
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x006605b8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x5e3fc1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x5e3ea0
sub eax, 4
and eax, 0xfffffffb
jne 0x5e3f30
add dword [0x006605b4], 1
cmp ebx, 8
jae 0x5e3ed8
test bl, 4
jne 0x5e3f80
test ebx, ebx
je 0x5e3ec9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x5e3fa0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x5e3ec9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x5e3f0a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x006605b8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x5e3ea0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.005e3d60
nop dword [rax]
xor edi, edi
jmp 0x5e3e27
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x5e3ec9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x5e3ec9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.005e3d60
mov rax, qword [0x006605b8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.005e3d60
nop
nop dword [rax]
Function at 0x5e47a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x006608a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00660880]
test rbx, rbx
je 0x5e47f4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x5e47eb
test r12, r12
je 0x5e47eb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x5e47d0
lea rcx, [0x006608a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x5e4b30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0064bfb0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x5e4ba9
mov rcx, r10
call fcn.005e4a00
test eax, eax
je 0x5e4ba9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x5e4ba6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x5e4b9d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x5e4ba9
add r8, 0x28
cmp r8, r9
jne 0x5e4b88
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x14005afd0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x1400af760], rbx
je 0x14005b037
cmp rax, rbx
jne 0x14005b02a
mov ebx, 1
mov esi, ebx
jmp 0x14005b03c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14005b00f
mov ebx, 1
mov eax, dword [0x1400af768]
cmp eax, ebx
jne 0x14005b054
mov edi, AtlInternalQueryInterface
mov ecx, edi
call fcn.140142000
jmp 0x14005b0c0
mov eax, dword [0x1400af768]
test eax, eax
jne 0x14005b0b5
mov dword [0x1400af768], ebx
lea r15, [0x140062ee0]
lea rdi, [0x140062ec8]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14005b0a7
test eax, eax
jne 0x14005b0ab
cmp qword [rdi], r14
je 0x14005b09c
mov rax, qword [rdi]
mov rcx, qword [0x140062e08]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14005b07e
test eax, eax
je 0x14005b0bb
mov eax, 0xff
jmp 0x14005b216
mov dword [0x1400ae8a4], ebx
mov edi, AtlInternalQueryInterface
mov eax, dword [0x1400af768]
cmp eax, ebx
jne 0x14005b0e7
lea rdx, [0x140062ec0]
lea rcx, [0x140062e10]
call sub.msvcrt.dll__initterm
mov dword [0x1400af768], 2
test esi, esi
jne 0x14005b0f5
mov rax, r14
xchg qword [0x1400af760], rax
cmp qword [0x1400af780], r14
je 0x14005b128
lea rcx, [0x1400af780]
call fcn.14005b820
test eax, eax
je 0x14005b128
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400af780]
mov r9, qword [0x140062e08]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14005b141
mov eax, 0xff
jmp 0x14005b216
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14005b1c7
test ax, ax
je 0x14005b15c
test edx, edx
jne 0x14005b1c7
sub ax, bx
cmp ax, di
ja 0x14005b172
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14005b15c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140007150
mov dword [0x1400ae8a0], eax
cmp dword [0x1400ae8c0], r14d
jne 0x14005b1b0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400ae8a4], r14d
jne 0x14005b1c5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400ae8a0]
jmp 0x14005b216
cmp ax, 0x22
jne 0x14005b1db
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14005b14a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14005b8b4
add rsp, 0x28
jmp 0x14005afd0
Function at 0x613c1446
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov edx, 1
lea rcx, section.......
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x613c1550
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x613c7024]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x613c166a
mov rax, qword [0x613c7028]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x613c159e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x613c1650
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x613c1582
mov rcx, rbx
call fcn.613c2370
test rax, rax
mov r12, rax
je 0x613c16a2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x613c7028]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.613c2490
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x613c7028]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x613c1685
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x613c1649
sub eax, 0x40
and eax, 0xffffffbf
je 0x613c1649
mov r9, rbp
add r9, qword [0x613c7028]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x613c1671
add dword [0x613c7024], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp 0x613c28b0
xor ebp, ebp
jmp 0x613c15ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x613c4098]
mov edx, eax
call fcn.613c14e0
mov rax, qword [0x613c7028]
mov edx, dword [r12 + 8]
lea rcx, [0x613c4060]
mov r8, qword [rax + rbp + 8]
call fcn.613c14e0
lea rcx, [0x613c4040]
mov rdx, rbx
call fcn.613c14e0
nop
nop word cs:[rax + rax]
jmp qword [sym.imp.msvcrt.dll_memcpy]

Function at 0x613c2280
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x613c22c1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x613c22b8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x613c22c3
add rax, 0x28
cmp rax, r9
jne 0x613c22a4
xor eax, eax
repz ret

Function at 0x613c2370
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x613c41b0]
cmp word [rbx], 0x5a4d
je 0x613c2390
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call fcn.613c2240
test eax, eax
je 0x613c2384
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.613c2280
Function at 0x14001605f
Capabilities:
Set registry value

Disassembly:
jmp 0x1400393c0
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, reloc.Cabinet.dll_FCIDestroy
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x148]
mov rax, qword [0x140073340]
xor rax, rbp
mov qword [rbp + 0xe8], rax
lea rcx, [0x14007db67]
call fcn.140016b68
cmp qword [rbp + 0x118], 0
je 0x140039435
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x140039449
mov qword [rbp + 0x10], 0
xor eax, eax
mov word [rbp + 8], ax
xor eax, eax
mov word [rbp + 0xa], ax
mov eax, dword [rbp + 0x130]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x128]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x120]
xor r8d, r8d
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14005fad0]
call fcn.1400169a6
mov rax, rdi
mov rcx, qword [rbp + 0xe8]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0xf8]
pop rdi
pop rbp
ret

Function at 0x140016096
Capabilities:
Create thread
Terminate thread

Disassembly:
jmp 0x140031660
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
mov rax, qword [0x140073340]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x14007d6df]
call fcn.140016b68
lea rax, [rbp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0x140]
lea r8, [0x140016140]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400316e2
jmp 0x140031774
lea rax, [rbp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140016172]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14003173e
mov edx, 0x3a98
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140031734
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x2710
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140031760
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test eax, eax
jne 0x1400316a9
mov eax, dword [0x140073504]
cmp eax, 1
jne 0x14003178b
mov dword [rbp + 0x114], 1
jmp 0x140031795
mov dword [rbp + 0x114], 0
mov eax, dword [rbp + 0x114]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140059320]
call fcn.1400169a6
mov eax, edi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x1400160d7
Capabilities:
Delete registry value
Set registry value

Disassembly:
jmp 0x14003ac90
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1a8]
mov rax, qword [0x140073340]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x14007db67]
call fcn.140016b68
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
cmp qword [rbp + 0x170], 0
jne 0x14003ad04
jmp 0x14003ae42
cmp qword [rbp + 0x168], 0
jne 0x14003ad1b
lea rax, str.Environment
mov qword [rbp + 0x68], rax
jmp 0x14003ad26
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x178], 0
jne 0x14003ad3e
cmp dword [rbp + 0x160], 0
jne 0x14003ad3e
jmp 0x14003ae42
lea r8, [rbp + 0x28]
mov rdx, qword [rbp + 0x68]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14003ad5c
jmp 0x14003ae42
cmp dword [rbp + 0x160], 0
je 0x14003ad9b
mov rdx, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x14003ad86
mov dword [rbp + 0x134], 1
jmp 0x14003ad90
mov dword [rbp + 0x134], 0
mov eax, dword [rbp + 0x134]
mov dword [rbp + 4], eax
jmp 0x14003adff
mov rcx, qword [rbp + 0x178]
call fcn.1400162a3
lea rax, [rax + rax + 2]
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 0x44]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x178]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14003adec
mov dword [rbp + 0x134], 1
jmp 0x14003adf6
mov dword [rbp + 0x134], 0
mov eax, dword [rbp + 0x134]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14003ae38
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x3e8
mov dword [rsp + 0x20], 1
mov r9, qword [rbp + 0x170]
xor r8d, r8d
mov edx, 0x1a
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
xor eax, eax
test eax, eax
jne 0x14003acf5
cmp qword [rbp + 0x28], 0
je 0x14003ae5d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x14005f2a0]
call fcn.1400169a6
mov eax, edi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1400160fa
Capabilities:
Print debug messages

Disassembly:
jmp 0x14002d730
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [0x140073340]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x14007d2db]
call fcn.140016b68
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov dword [rbp + 0x64], 0x80004005
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 0x84], eax
lea r9, [rbp + 0x28]
mov r8d, 4
lea rdx, [0x140068860]
lea rcx, str.3AD05575_8857_4850_9277_11B85BDB8E09
call fcn.140016965
test eax, eax
je 0x14002d7d0
jmp 0x14002d87e
cmp qword [rbp + 0x28], 0
jne 0x14002d7dc
jmp 0x14002d87e
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [0x140073c58]
mov edx, dword [rcx + 0x10]
mov rcx, qword [rbp + 0x28]
call qword [rax + 0x28]
test eax, eax
je 0x14002d7fd
jmp 0x14002d87e
lea r9, [rbp + 0x48]
lea r8, [0x140068440]
xor edx, edx
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
test eax, eax
je 0x14002d81d
jmp 0x14002d87e
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call qword [rax + 0x90]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x14002d840
jmp 0x14002d87e
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x28]
call qword [rax + 0xa8]
test eax, eax
je 0x14002d857
jmp 0x14002d87e
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + InitCommonControls]
mov qword [rbp + 0x48], 0
mov dword [rbp + 4], 1
xor eax, eax
test eax, eax
jne 0x14002d7aa
cmp qword [rbp + 0x28], 0
je 0x14002d893
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x28]
call qword [rax + InitCommonControls]
cmp qword [rbp + 0x48], 0
je 0x14002d8a8
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + InitCommonControls]
cmp dword [rbp + 0x84], 0
jne 0x14002d8b7
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rbp + 4], 0
je 0x14002d8d9
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str._r_nCleanup_success_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14002d8e6
lea rcx, str._r_nCleanup_failed_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1400169a6
mov eax, edi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x140016118
Capabilities:
Create process on windows

Disassembly:
jmp 0x14003a710
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [0x140073340]
xor rax, rbp
mov qword [rbp + 0x148], rax
lea rcx, [0x14007db67]
call fcn.140016b68
mov edx, 0x70
lea rcx, [rbp + 0x10]
call fcn.140016825
mov dword [rbp + 0x10], 0x70
mov dword [rbp + 0x14], 0x440
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x30], rax
mov eax, dword [rbp + 0x188]
mov dword [rbp + 0x40], eax
mov rax, qword [rbp + 0x180]
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14003a7c2
mov rax, qword [rbp + 0x78]
jmp 0x14003a7c4
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14005e920]
call fcn.1400169a6
mov rax, rdi
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret

Function at 0x14001612c
Capabilities:
Write file on windows

Disassembly:
jmp 0x14003c890
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140073340]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x14007db67]
call fcn.140016b68
mov dword [rbp + 0x24], 0
cmp qword [rbp + 0x128], 0
je 0x14003c8fd
cmp dword [rbp + 0x130], 0
jne 0x14003c904
xor eax, eax
jmp 0x14003c9b0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x14003c971
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003c989
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateFile
call fcn.140016366
xor eax, eax
jmp 0x14003c9b0
mov eax, dword [rbp + 0x130]
cmp dword [rbp + 0x24], eax
jne 0x14003c9a0
mov dword [rbp + 0xf4], 1
jmp 0x14003c9aa
mov dword [rbp + 0xf4], 0
mov eax, dword [rbp + 0xf4]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14005e5b0]
call fcn.1400169a6
mov rax, rdi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140016177
Capabilities:
Delete file

Disassembly:
jmp 0x14002ad90
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x718
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x738]
mov rax, qword [0x140073340]
xor rax, rbp
mov qword [rbp + 0x6e8], rax
lea rcx, [0x14007d1da]
call fcn.140016b68
mov dword [rbp + 4], 0xc0000022
mov rax, qword [0x140073c58]
cmp dword [rax + 8], 0x4a61
jae 0x14002ae00
mov dword [rbp + 0x6e4], 1
jmp 0x14002ae0a
mov dword [rbp + 0x6e4], 2
mov eax, dword [rbp + 0x6e4]
mov dword [rbp + 0x44], eax
mov dword [rbp + 0x24], 0
jmp 0x14002ae24
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x44]
cmp dword [rbp + 0x24], eax
jae 0x14002aede
mov eax, dword [rbp + 0x24]
lea rcx, str.dismcore.dll
mov r9d, dword [rbp + 0x718]
mov r8, qword [rbp + 0x710]
mov rdx, qword [rcx + rax*8]
xor ecx, ecx
call fcn.1400161a4
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jl 0x14002ae64
call fcn.140016b13
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x14002aece
mov rax, qword [0x140073c58]
add rax, 0x47c
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.1400161f9
mov eax, dword [rbp + 0x24]
lea rcx, str.dismcore.dll
mov rdx, qword [rcx + rax*8]
lea rcx, [rbp + 0x90]
call fcn.140016af0
lea rcx, [rbp + 0x90]
call fcn.1400162a3
mov qword [rbp + 0x68], rax
mov eax, 0x7e
mov rcx, qword [rbp + 0x68]
mov word [rbp + rcx*2 + 0x8e], ax
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002ae1c
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400566c0]
call fcn.1400169a6
mov eax, edi
mov rcx, qword [rbp + 0x6e8]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x6f8]
pop rdi
pop rbp
ret