joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400332d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x140055200]
xor rax, rsp
mov qword [rbp + 0x760], rax
mov rsi, qword [rbp + 0x7c0]
mov rdi, r8
movzx r9d, r9b
shl r9d, 8
add r9d, 0x20019
cmp qword [rdx + 0x18], 8
jb 0x14000baae
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r14d, r14d
mov dword [rsp + 0x3c], 0x820
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x38], r14d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000bb6d
cmp qword [rdi + 0x18], 8
jb 0x14000baf1
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000bb62
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
jbe 0x14000bb3f
mov ebx, 0x8007065d
jmp 0x14000bb62
mov ebx, r14d
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x14000bb4b
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14000305c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1400376e0
add rsp, 0x870
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
push rbx
mov rax, qword [rsp + 0x38]
mov r10, r9
mov r9b, byte [rsp + 0x30]
mov r11, r8
mov rcx, rdx
mov qword [rsp + 0x30], rax
mov r8, r10
mov rdx, r11
pop rbx
jmp 0x14000ba64
Function at 0x140033310
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140055200]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov rax, qword [rcx]
cmp rax, qword [rcx + 8]
je 0x14000bcca
mov qword [rcx + 8], rax
xor r14d, r14d
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x40], r14
mov dword [rbp - 0x4c], r14d
mov qword [rbp - 0x30], r14
movdqa xmm0, xmmword [0x140046750]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
lea rcx, [rbp - 0x30]
call fcn.14000bb8c
mov edi, eax
test eax, eax
js 0x14000be19
mov dword [rsp + 0x20], 0xf0000040
lea r9d, [r14 + 0x18]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
setne cl
test eax, eax
je 0x14000bd49
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
setne cl
test cl, cl
je 0x14000bdf2
mov edx, 4
mov dword [rbp - 0x48], edx
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x48]
lea r8, [rbp - 0x4c]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000bdf2
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r8d, dword [rbp - 0x20]
add r8d, r8d
xor r9d, r9d
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
setne sil
test eax, eax
je 0x14000bdeb
mov eax, dword [rbp - 0x4c]
mov dword [rbp - 0x48], eax
mov edx, eax
lea r8, [rbp - 0x50]
mov rcx, rbx
call fcn.1400065d8
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x48]
mov r8, qword [rbx]
mov edx, 2
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
setne sil
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test sil, sil
jne 0x14000be19
jmp 0x14000be0c
mov dword [rbp - 0x4c], r14d
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, qword [rbx]
cmp rax, qword [rbx + 8]
je 0x14000be19
mov qword [rbx + 8], rax
mov eax, 0x80004005
mov rcx, qword [rbx + 8]
cmp qword [rbx], rcx
cmove edi, eax
lea rcx, [rbp - 0x30]
call fcn.140002ff8
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400376e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rcx, rdx
jmp 0x14000bc94
Function at 0x140033350
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140055200]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov rax, rcx
cmp qword [rcx + 0x18], 8
jb 0x14000c328
mov rax, qword [rcx]
xor edi, edi
mov qword [rcx + 0x10], rdi
mov word [rax], di
mov dword [rbp - 0x30], edi
lea r8, [rbp - 0x30]
xor edx, edx
lea ecx, [rdi + 8]
call sub.Secur32.dll_GetUserNameExW
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x14000c3cd
xorps xmm0, xmm0
mov edx, eax
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rdi
lea rcx, [rbp - 0x28]
call fcn.1400053ac
nop
lea r8, [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
lea ecx, [rdi + 8]
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x14000c38a
mov r8d, dword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov rcx, rbx
call fcn.14000305c
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14000c3cd
mov rdx, qword [rbp - 0x18]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c3c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c3c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003797c
cmp qword [rbx + 0x10], rdi
setne al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400376e0
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov rcx, rdx
jmp 0x14000c2f8

Function at 0x140033390
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140010024
mov cl, al
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14000c640
mov rcx, rdx
jmp 0x14000c620

Function at 0x1400333a0
Capabilities:
Get common file path

Disassembly:
mov cl, dl
mov rdx, r8
jmp fcn.14000c640

Function at 0x1400333f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140055200]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x34], 1
xor ebx, ebx
mov dword [rsp + 0x30], 0x104
call fcn.14000c5ec
mov rcx, rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8, str.Version
lea rax, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftOneDrive
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x14000ccdd
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x14000ccc4
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000305c
jmp 0x14000cce2
mov ebx, 0x80004005
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400376e0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
mov rcx, rdx
jmp 0x14000cc3c

Function at 0x140033400
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
mov rax, qword [rsp + 0x38]
mov r10, r9
mov r9b, byte [rsp + 0x30]
mov r11, r8
mov rcx, rdx
mov qword [rsp + 0x30], rax
mov r8, r10
mov rdx, r11
pop rbx
jmp fcn.14000cdb0
Function at 0x140033430
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
mov rax, qword [rsp + 0x38]
mov r10, r9
mov r9d, dword [rsp + 0x30]
mov r11, r8
mov rcx, rdx
mov qword [rsp + 0x30], rax
mov r8, r10
mov rdx, r11
pop rbx
jmp fcn.14000cdbc

Function at 0x140033460
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
mov rax, qword [rsp + 0x38]
mov r10, r9
mov r9b, byte [rsp + 0x30]
mov r11, r8
mov rcx, rdx
mov qword [rsp + 0x30], rax
mov r8, r10
mov rdx, r11
pop rbx
jmp fcn.14000cec0
Function at 0x1400335f0
Capabilities:
Decode data using base64 via winapi
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x120
mov rax, qword [0x140055200]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r14b, cl
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x78], r15
movdqa xmm0, xmmword [0x140046750]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r15w
call fcn.1400298a0
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x2b0]
lea rdx, [rsp + 0x48]
mov rcx, r8
call qword [case.0x14002e1f3.0]
lea edi, [r15 + 0x64]
test eax, eax
js 0x14000e13c
mov dword [rsp + 0x40], r15d
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
sub rax, rcx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x40000001
mov edx, eax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov ebx, eax
test eax, eax
setne sil
xorps xmm0, xmm0
mov edx, dword [rsp + 0x40]
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
lea rcx, [rsp + 0x60]
call fcn.1400053ac
nop
test ebx, ebx
je 0x14000e087
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
sub rax, rcx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9, qword [rsp + 0x60]
mov r8d, 0x40000001
mov edx, eax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
setne sil
mov r8, rdi
xor edx, edx
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
test sil, sil
je 0x14000e0f2
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
mov r8d, 1
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x14000e0f2
call fcn.1400298a0
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x130]
mov r8b, r14b
mov dl, byte [rbp - 0x60]
mov rcx, r9
call qword [case.0x14002e1f3.0]
mov edi, eax
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x14000e13c
mov rcx, qword [rsp + 0x70]
sub rcx, r8
sar rcx, 1
lea rdx, [rcx + rcx]
mov rax, r8
cmp rdx, 0x1000
jb 0x14000e133
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e133
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.14003797c
nop
lea rcx, [rsp + 0x78]
call fcn.140002ff8
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000e186
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e181
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e181
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003797c
mov eax, edi
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400376e0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov cl, dl
jmp 0x14000df7c
Function at 0x140033890
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140055200]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
lea rax, [rsp + 0x60]
lea rdx, str.SoftwareClasses
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
lea edi, [rbx + 1]
mov r9d, edi
lea r8d, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140010f6b
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x58], rbx
xor r9d, r9d
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x48], rbx
xor edx, edx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140010f60
cmp dword [rsp + 0x68], ebx
jne 0x140010f60
cmp dword [rsp + 0x6c], edi
jne 0x140010f60
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rbx
lea r8, str.SymbolicLinkValue
mov qword [rsp + 0x28], rbx
mov r9d, 0x1000ffff
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140010f60
cmp dword [rsp + 0x70], 6
movzx ebx, bl
cmove ebx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400376e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
jmp 0x140010e80

Function at 0x140033a50
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140055200]
xor rax, rsp
mov qword [rsp + 0x38], rax
neg byte [rsp + 0x80]
mov rsi, r9
mov rbx, r8
sbb r9d, r9d
and r9d, 0xfffe00fc
add r9d, 0x20006
cmp qword [rdx + 0x18], 8
jb 0x140013917
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140013973
cmp qword [rbx + 0x10], 0
jne 0x14001393b
xor ebx, ebx
jmp 0x140013945
cmp qword [rbx + 0x18], 8
jb 0x140013945
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400376e0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
push rbx
mov al, byte [rsp + 0x38]
mov r10, r9
mov r9, qword [rsp + 0x30]
mov r11, r8
mov rcx, rdx
mov byte [rsp + 0x30], al
mov r8, r10
mov rdx, r11
pop rbx
jmp 0x1400138d8

Function at 0x140033a80
Capabilities:
Set registry value

Disassembly:
push rbx
mov al, byte [rsp + 0x38]
mov r10, r9
mov r9, qword [rsp + 0x30]
mov r11, r8
mov rcx, rdx
mov byte [rsp + 0x30], al
mov r8, r10
mov rdx, r11
pop rbx
jmp fcn.140013998
Function at 0x140035634
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140055200]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14b, r8b
mov esi, edx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov qword [rcx], r15
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
mov dword [rsp + 0x30], 1
call fcn.1400298a0
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x350]
call qword [case.0x14002e1f3.0]
mov dil, al
test al, al
jne 0x140035766
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140035766
lea rdx, [0x140046300]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
je 0x140035766
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x14003570f
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000325c
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 9
lea r9, str._allusers
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
call fcn.140006728
cmp rax, 0xffffffffffffffff
setne dil
lea rcx, [rsp + 0x40]
call fcn.140002ff8
mov rdx, rbx
mov cl, dil
call fcn.14000c5b0
mov r8d, 1
lea rdx, [0x14003f28c]
mov rcx, rbx
call fcn.140003108
mov dl, r14b
mov ecx, esi
call fcn.1400359ac
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140003e70
mov dword [rsp + 0x30], 3
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140003108
nop
lea rcx, [rsp + 0x40]
call fcn.140002ff8
mov rax, rbx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400376e0
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x280
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140038600
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003864a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003864a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003864a
mov eax, SHFlushSFCache
cmp word [rcx + 0x18], ax
jne 0x14003864a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003864a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003864c
xor al, al
add rsp, 0x28
ret
Function at 0x1400010b0
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub rsp, 0x368
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x350], rax
call fcn.140001000
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x104
call fcn.140002660
xor edx, edx
lea rcx, [rsp + 0x130]
mov r8d, 0x104
call fcn.140002660
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.140002660
mov edx, 0x103
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r9, str.kernel64.dll
lea r8, [rsp + 0x240]
lea rdx, str._s_s
lea rcx, [rsp + 0x20]
call fcn.140001220
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1400011c4
mov r8d, 0x103
lea rdx, [rsp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x130]
call fcn.1400022c0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
mov byte [rax], 0
call fcn.140002660
lea r9, str.kernel64.dll
lea r8, [rsp + 0x130]
lea rdx, str._s_s
lea rcx, [rsp + 0x20]
call fcn.140001220
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1400011c4
lea rcx, str.Error_Code___3_n
call fcn.140001360
lea rdx, [rsp + 0x20]
call fcn.1400014c0
test eax, eax
jne 0x1400011f9
lea rcx, str.Error_Code_5_n
call fcn.140001360
or eax, 0xffffffff
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.140001660
add rsp, 0x368
ret
xor eax, eax
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.140001660
add rsp, 0x368
ret
Function at 0x140001360
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x590
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x580], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x104
call fcn.140002660
xor edx, edx
lea rcx, [rsp + 0x180]
mov r8d, 0x400
call fcn.140002660
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x50], 0x12345678
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, str.C:WindowsTemp_d.log
lea rcx, [rsp + 0x70]
call fcn.140001220
movzx ecx, word [rsp + 0x62]
movzx edx, word [rsp + 0x60]
movzx eax, word [rsp + 0x64]
movzx r10d, word [rsp + 0x5e]
movzx r9d, word [rsp + 0x5a]
movzx r8d, word [rsp + 0x58]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x180]
mov dword [rsp + 0x28], edx
lea rdx, str._n_d._02d._02d__02d:_02d:_02d_t_t_s_n
mov dword [rsp + 0x20], r10d
call fcn.1400015f0
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400014a7
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rax, [rsp + 0x180]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140001475
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.140001660
add rsp, 0x590
pop rbx
ret
Function at 0x140004fc0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140004d94
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004d94
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004d94
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004d94
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004d94
cmp dword [rcx + 0x84], 0xe
jbe 0x140004d94
cmp dword [rcx + 0xf8], esi
je 0x140004d94
mov ecx, r14d
call fcn.140004edc
mov ecx, 2
call fcn.140009100
nop
cmp byte [0x14001b2b0], 0
jne 0x140004e5e
mov r15d, 1
mov eax, r15d
xchg dword [0x14001b2a4], eax
test ebx, ebx
jne 0x140004e07
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14001b2a8]
cmp rcx, rax
je 0x140004dfe
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140001de0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14001b2c0]
jmp 0x140004e13
cmp ebx, r15d
jne 0x140004e19
lea rcx, [0x14001b2d8]
call fcn.1400054d0
nop
test ebx, ebx
jne 0x140004e30
lea rdx, [0x1400102f8]
lea rcx, [0x1400102d8]
call fcn.140004c54
lea rdx, [0x140010308]
lea rcx, [0x140010300]
call fcn.140004c54
movzx eax, byte [0x14001b2b0]
test esi, esi
cmove eax, r15d
mov byte [0x14001b2b0], al
jmp 0x140004e5e
mov ecx, 2
call fcn.140009154
test esi, esi
jne 0x140004e75
mov ecx, r14d
call fcn.140004e90
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140004d24