joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c858
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x150
mov rsi, rcx
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x40], 0
call sub.msvcrt.dll_memset
mov rax, qword [rsi + 0x258]
cmp byte [rax + 0x258], 0
je 0x14000c8a3
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14000c674
jmp 0x14000c8a5
xor eax, eax
test eax, eax
je 0x14000ca8e
cmp dword [0x1400163b8], 0
jne 0x14000c8d3
lea rcx, [0x140016390]
mov edx, 0x8000
mov r9d, 0x1000
mov r8d, 0x100
call fcn.140007550
mov edx, dword [0x1400163b0]
xor eax, eax
test edx, edx
jle 0x14000c8f6
mov rcx, qword [0x1400163a0]
cmp dword [rcx], 5
je 0x14000c94b
add eax, 1
add rcx, 4
cmp eax, edx
jl 0x14000c8e6
xor ebx, ebx
test rbx, rbx
jne 0x14000ca2a
cmp byte [0x140016140], bl
je 0x14000c961
lea rdx, str.strings
lea rcx, [0x140016250]
call fcn.140010a1c
mov rdx, qword [0x140016398]
lea ecx, [rbx + 5]
call fcn.140007be8
test eax, eax
je 0x14000c942
mov rcx, qword [0x140016398]
call sub.msvcrt.dll_strlen
test eax, eax
mov rdi, rax
jne 0x14000c992
mov rcx, qword [0x1400152a0]
jmp 0x14000c973
movsxd rcx, eax
mov rax, qword [0x1400163a8]
mov ebx, dword [rax + rcx*4]
add rbx, qword [0x140016390]
jmp 0x14000c8f8
mov rcx, qword [0x140016138]
test rcx, rcx
cmove rcx, qword [0x1400152a0]
mov r9d, dword [0x1400163c0]
mov r8, qword [0x140016398]
mov edx, 5
add r9d, 0xffffffff
call qword [sym.imp.USER32.dll_LoadStringA]
mov edi, eax
test edi, edi
jle 0x14000ca23
movsxd rcx, dword [0x1400163b4]
lea eax, [rcx + rdi + 2]
cmp eax, dword [0x1400163b8]
jge 0x14000ca23
mov eax, dword [0x1400163bc]
cmp dword [0x1400163b0], eax
jge 0x14000ca23
mov rdx, qword [0x140016398]
mov rbx, rcx
lea eax, [rdi + 1]
add rbx, qword [0x140016390]
movsxd r8, eax
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [0x1400163b4]
movsxd r11, dword [0x1400163b0]
mov rcx, qword [0x1400163a8]
mov dword [rcx + r11*4], eax
movsxd rcx, dword [0x1400163b0]
mov rax, qword [0x1400163a0]
mov dword [rax + rcx*4], 5
mov eax, dword [0x1400163b4]
add dword [0x1400163b0], 1
test rbx, rbx
lea ecx, [rax + rdi + 1]
mov dword [0x1400163b4], ecx
jne 0x14000ca2a
lea rbx, [0x14001178f]
and dword [rsp + 0x30], 0
mov rcx, qword [rsi + 0x498]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
lea r9, [0x140011ff0]
lea rdx, str.Backup_Filename__.bak_
mov r8, rbx
mov qword [rsp + 0x20], rax
call fcn.140006bdc
test eax, eax
je 0x14000ca8e
mov rcx, qword [rsi + 0x258]
lea rdx, [rsp + 0x40]
xor r8d, r8d
add rcx, 0x258
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x14000ca8e
mov rcx, qword [rsi + 0x498]
xor edx, edx
call fcn.140006190
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000caa4
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x150
mov rdi, rcx
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x40], 0
call sub.msvcrt.dll_memset
mov rax, qword [rdi + 0x258]
cmp byte [rax + 0x258], 0
je 0x14000caef
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000c674
jmp 0x14000caf1
xor eax, eax
test eax, eax
je 0x14000ccf2
cmp dword [0x1400163b8], 0
jne 0x14000cb1f
lea rcx, [0x140016390]
mov edx, 0x8000
mov r9d, 0x1000
mov r8d, 0x100
call fcn.140007550
mov edx, dword [0x1400163b0]
xor eax, eax
test edx, edx
jle 0x14000cb42
mov rcx, qword [0x1400163a0]
cmp dword [rcx], 6
je 0x14000cb97
add eax, 1
add rcx, 4
cmp eax, edx
jl 0x14000cb32
xor ebx, ebx
test rbx, rbx
jne 0x14000cc76
cmp byte [0x140016140], bl
je 0x14000cbad
lea rdx, str.strings
lea rcx, [0x140016250]
call fcn.140010a1c
mov rdx, qword [0x140016398]
lea ecx, [rbx + 6]
call fcn.140007be8
test eax, eax
je 0x14000cb8e
mov rcx, qword [0x140016398]
call sub.msvcrt.dll_strlen
test eax, eax
mov rsi, rax
jne 0x14000cbde
mov rcx, qword [0x1400152a0]
jmp 0x14000cbbf
movsxd rcx, eax
mov rax, qword [0x1400163a8]
mov ebx, dword [rax + rcx*4]
add rbx, qword [0x140016390]
jmp 0x14000cb44
mov rcx, qword [0x140016138]
test rcx, rcx
cmove rcx, qword [0x1400152a0]
mov r9d, dword [0x1400163c0]
mov r8, qword [0x140016398]
mov edx, 6
add r9d, 0xffffffff
call qword [sym.imp.USER32.dll_LoadStringA]
mov esi, eax
test esi, esi
jle 0x14000cc6f
movsxd rcx, dword [0x1400163b4]
lea eax, [rcx + rsi + 2]
cmp eax, dword [0x1400163b8]
jge 0x14000cc6f
mov eax, dword [0x1400163bc]
cmp dword [0x1400163b0], eax
jge 0x14000cc6f
mov rdx, qword [0x140016398]
mov rbx, rcx
lea eax, [rsi + 1]
add rbx, qword [0x140016390]
movsxd r8, eax
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [0x1400163b4]
movsxd r11, dword [0x1400163b0]
mov rcx, qword [0x1400163a8]
mov dword [rcx + r11*4], eax
movsxd rcx, dword [0x1400163b0]
mov rax, qword [0x1400163a0]
mov dword [rax + rcx*4], 6
mov eax, dword [0x1400163b4]
add dword [0x1400163b0], 1
test rbx, rbx
lea ecx, [rax + rsi + 1]
mov dword [0x1400163b4], ecx
jne 0x14000cc76
lea rbx, [0x14001178f]
and dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x498]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
lea r9, [0x140011ff0]
lea rdx, str.Backup_Filename__.bak_
mov r8, rbx
mov qword [rsp + 0x20], rax
call fcn.140006b58
test eax, eax
je 0x14000ccf2
mov rdx, qword [rdi + 0x258]
lea rcx, [rsp + 0x40]
xor r8d, r8d
add rdx, 0x258
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x14000ccda
mov rcx, qword [rdi + 0x498]
xor edx, edx
call fcn.140006190
mov rcx, qword [rdi + 0x498]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x415
call qword [sym.imp.USER32.dll_PostMessageA]
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000cf98
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
lea rsi, [rcx + 0x268]
mov ebx, r8d
mov r13, rdx
mov rdi, rcx
lea r12, [0x14001178f]
or r8d, 0xffffffff
mov rdx, r12
mov rcx, rsi
xor ebp, ebp
call fcn.1400070fc
test ebx, ebx
mov dword [rdi + 0x27c], 0x2000
je 0x14000cffd
mov rdx, qword [rdi + 0x258]
mov r8d, 0x9c5b
mov rcx, rdi
call fcn.14000c0a0
jmp 0x14000d03e
mov rax, qword [rdi + 0x258]
xor ebx, ebx
cmp dword [rax + 0x18], ebx
jle 0x14000d03e
mov rcx, qword [rdi + 0x258]
mov edx, ebx
mov rax, qword [rcx]
call qword [rax + 0xc0]
mov rcx, qword [rdi + 0x258]
mov rdx, rsi
mov r8, rax
call fcn.14000304c
mov rax, qword [rdi + 0x258]
add ebx, 1
cmp ebx, dword [rax + 0x18]
jl 0x14000d00b
cmp dword [rsi + 0x10], ebp
je 0x14000d048
mov ebx, dword [rsi + 0xc]
jmp 0x14000d05c
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000d05a
call sub.msvcrt.dll_strlen
mov rbx, rax
jmp 0x14000d05c
xor ebx, ebx
xor edx, edx
mov rcx, r13
call fcn.1400060ec
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x14000d0a4
cmp qword [rsi], 0
lea r9, [rsp + 0x60]
mov r8d, ebx
cmovne r12, qword [rsi]
and dword [rsp + 0x60], 0
and qword [rsp + 0x20], 0
mov rdx, r12
mov rcx, rax
mov ebp, 1
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret

Function at 0x14000d0c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rsi, [0x14001178f]
or r8d, 0xffffffff
mov rdx, rsi
add rcx, 0x268
call fcn.1400070fc
mov rdx, qword [rdi + 0x258]
mov r8d, 0x9c5b
mov rcx, rdi
mov dword [rdi + 0x27c], 0x2000
call fcn.14000c0a0
cmp qword [rdi + 0x268], 0
mov rcx, qword [rdi + 0x498]
cmovne rsi, qword [rdi + 0x268]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14000d18f
call qword [sym.imp.USER32.dll_EmptyClipboard]
test rsi, rsi
je 0x14000d189
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov ecx, 0x2000
add eax, 1
movsxd rdi, eax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x14000d189
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d6a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor r9d, r9d
mov dword [rsp + 0x20], edx
lea rdx, [rcx + 0x14b]
lea r8d, [r9 + 4]
mov rbx, rcx
call fcn.14000bd80
test eax, eax
je 0x14000d6f7
mov rcx, qword [rbx + 0x498]
lea r9, [0x14001178f]
lea r8, [rbx + 0x14b]
lea rdx, str.open
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r9
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000d794
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x14b
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [rbx + 0x258]
mov rdx, qword [rbx + 0x250]
mov eax, dword [rax + 0x1c8]
mov dword [rdx + 0x2c], eax
mov rdx, qword [rbx + 0x250]
mov rcx, qword [rbx + 0x498]
mov dword [rdx], 0x2c
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov rcx, qword [rbx + 0x250]
mov rcx, qword [rcx + 0x30]
call fcn.140008420
mov rcx, qword [rbx + 0x250]
mov edx, 1
call fcn.14000fde8
mov rcx, rbx
call fcn.14000d704
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_PostQuitMessage]
Function at 0x14000e824
Capabilities:
Gather firefox profile information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r13
push r14
sub rsp, 0xe0
and qword [rsp + 0x78], 0
mov r13, rcx
lea rcx, [rsp + 0x30]
mov rbx, rdx
xor esi, esi
call fcn.1400106b4
test eax, eax
je 0x14000ea96
mov rax, qword [rsp + 0x30]
and qword [rsp + 0x118], rsi
test rax, rax
je 0x14000ea96
lea rdx, [rsp + 0x118]
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x14000ea96
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14000e8ba
lea rdx, [rsp + 0xd0]
lea r9, [rsp + 0x110]
or r8d, 0xffffffff
mov qword [rsp + 0x20], rdx
lea rdx, str.SELECT_id__name__value__host__path__expiry__lastAccessed__isSecure__isHttpOnly__creationTime_FROM_moz_cookies
call rax
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x14000ea82
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
mov esi, 1
mov r14d, 0xffff
cmp qword [rsp + 0x40], 0
je 0x14000e8f6
call qword [rsp + 0x40]
mov rcx, qword [rsp + 0x110]
jmp 0x14000e8f9
mov eax, r14d
cmp eax, 0x64
jne 0x14000ea76
test rbx, rbx
je 0x14000e915
xor edx, edx
call rbx
mov rcx, qword [rsp + 0x110]
jmp 0x14000e918
mov rax, r14
test rdi, rdi
mov qword [rsp + 0x80], rax
je 0x14000e933
mov edx, esi
call rdi
mov rcx, qword [rsp + 0x110]
jmp 0x14000e935
xor eax, eax
test rdi, rdi
mov qword [rsp + 0x88], rax
je 0x14000e953
mov edx, 2
call rdi
mov rcx, qword [rsp + 0x110]
jmp 0x14000e955
xor eax, eax
test rdi, rdi
mov qword [rsp + 0x90], rax
je 0x14000e973
mov edx, 3
call rdi
mov rcx, qword [rsp + 0x110]
jmp 0x14000e975
xor eax, eax
test rdi, rdi
mov qword [rsp + 0x98], rax
je 0x14000e993
mov edx, 4
call rdi
mov rcx, qword [rsp + 0x110]
jmp 0x14000e995
xor eax, eax
test rbx, rbx
mov qword [rsp + 0xa0], rax
je 0x14000e9b3
mov edx, 5
call rbx
mov rcx, qword [rsp + 0x110]
jmp 0x14000e9b6
mov rax, r14
test rbx, rbx
mov qword [rsp + 0xa8], rax
je 0x14000e9d4
mov edx, 6
call rbx
mov rcx, qword [rsp + 0x110]
jmp 0x14000e9d7
mov rax, r14
cmp qword [rsp + 0x50], 0
mov qword [rsp + 0xb0], rax
je 0x14000e9fd
mov edx, 7
call qword [rsp + 0x50]
mov rcx, qword [rsp + 0x110]
mov r11d, eax
jmp 0x14000ea00
mov r11d, r14d
xor eax, eax
test r11d, r11d
setne al
cmp qword [rsp + 0x50], 0
mov dword [rsp + 0xc4], eax
je 0x14000ea2d
mov edx, 8
call qword [rsp + 0x50]
mov rcx, qword [rsp + 0x110]
mov r11d, eax
jmp 0x14000ea30
mov r11d, r14d
xor eax, eax
test r11d, r11d
setne al
test rbx, rbx
mov dword [rsp + 0xc0], eax
je 0x14000ea4d
mov edx, 9
call rbx
jmp 0x14000ea50
mov rax, r14
mov qword [rsp + 0xb8], rax
mov rax, qword [r13]
lea rdx, [rsp + 0x80]
mov rcx, r13
call qword [rax]
mov rcx, qword [rsp + 0x110]
jmp 0x14000e8e0
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x14000ea82
call rdx
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14000ea96
mov rcx, qword [rsp + 0x118]
call rdx
lea r11, [rsp + 0xe0]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x14000ef38
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x14001636c], 0
jne 0x14000f01b
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rbx, rax
je 0x14000f01b
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140015f48], rax
je 0x14000f008
lea rdx, str.Module32First
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140015f38], rax
je 0x14000f008
lea rdx, str.Module32Next
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140015f30], rax
je 0x14000f008
lea rdx, str.Process32First
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140015e10], rax
je 0x14000f008
lea rdx, str.Process32Next
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x14001636c]
mov edx, 1
test rax, rax
mov qword [0x140015e18], rax
cmovne ecx, edx
mov dword [0x14001636c], ecx
jmp 0x14000f00e
mov ecx, dword [0x14001636c]
test ecx, ecx
jne 0x14000f01b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x20
pop rbx
ret

Function at 0x14000f024
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140016370], 0
jne 0x14000f107
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbx, rax
je 0x14000f107
lea rdx, str.GetModuleBaseNameA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140015f60], rax
je 0x14000f0f4
lea rdx, str.EnumProcessModules
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140015f50], rax
je 0x14000f0f4
lea rdx, str.GetModuleFileNameExA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140015f40], rax
je 0x14000f0f4
lea rdx, str.EnumProcesses
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140015f68], rax
je 0x14000f0f4
lea rdx, str.GetModuleInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x140016370]
mov edx, 1
test rax, rax
mov qword [0x140015f58], rax
cmovne ecx, edx
mov dword [0x140016370], ecx
jmp 0x14000f0fa
mov ecx, dword [0x140016370]
test ecx, ecx
jne 0x14000f107
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x20
pop rbx
ret
Function at 0x14000f9e4
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x2040
call fcn.140010d80
sub rsp, rax
mov rdi, rdx
xor edx, edx
mov rbx, r8
test ecx, ecx
mov rsi, r9
lea r8d, [rax - 0x40]
lea rcx, [rsp + 0x31]
je 0x14000fa62
call sub.msvcrt.dll_memset
mov r11, qword [rsp + 0x2090]
mov byte [rsp + 0x30], 0
mov edx, dword [r11]
test edx, edx
je 0x14000fa41
lea r8, [rsp + 0x30]
mov rcx, rsi
call fcn.140006d4c
mov r9, qword [rsp + 0x2098]
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov r13d, eax
jmp 0x14000fb20
mov byte [rsp + 0x30], 0
call sub.msvcrt.dll_memset
mov r11, qword [rsp + 0x2098]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x30]
lea r8, [0x14001178f]
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x20], 0x2000
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor r13d, r13d
lea rcx, [rsp + 0x30]
test eax, eax
setne r13b
call sub.msvcrt.dll_strlen
test eax, eax
je 0x14000fb20
mov rbp, qword [rsp + 0x2090]
xor edi, edi
xor ebx, ebx
test eax, eax
mov r14d, dword [rbp]
movsxd r12, eax
jle 0x14000fb20
mov al, byte [rsp + rbx + 0x30]
cmp al, 0x20
jne 0x14000fad5
add rbx, 1
jmp 0x14000fb14
cmp edi, r14d
mov byte [rsp + 0x2070], al
mov al, byte [rsp + rbx + 0x31]
mov byte [rsp + 0x2071], al
mov byte [rsp + 0x2072], 0
jae 0x14000fb19
xor edx, edx
lea rcx, [rsp + 0x2070]
lea r8d, [rdx + 0x10]
call sub.msvcrt.dll_strtoul
add edi, 1
mov byte [rsi], al
add rsi, 1
add rbx, 2
cmp rbx, r12
jl 0x14000fac7
test edi, edi
je 0x14000fb20
mov dword [rbp], edi
lea r11, [rsp + 0x2040]
mov eax, r13d
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x14000fb40
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x120
test ecx, ecx
mov eax, r9d
mov rdi, r8
mov rsi, rdx
je 0x14000fbab
mov rax, qword [rsp + 0x150]
lea rcx, [rsp + 0x21]
xor edx, edx
mov ebx, dword [rax]
mov r8d, 0xfe
mov byte [rsp + 0x20], 0
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
mov r8d, 0xa
mov ecx, ebx
call sub.msvcrt.dll__itoa
mov r9, qword [rsp + 0x158]
mov rdx, rdi
mov r8, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x14000fbcc
mov r9, qword [rsp + 0x158]
mov r8d, eax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov rcx, qword [rsp + 0x150]
mov dword [rcx], eax
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000fbe4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x38]
mov rdi, r9
xor r8d, r8d
mov r9d, 0x20019
xor ebx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x14000fc54
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.PathToExe
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [rbx + 1]
cmp eax, ebx
cmove ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14000fd3c
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x38
cmp dword [rcx + 8], 0
mov r11, r9
lea rax, [rcx + 0x10]
je 0x14000fd5f
mov r9, rax
add rcx, 0x115
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x14000fd7f
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov r9, r8
mov r8, r11
add rcx, 0x115
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 1
add rsp, 0x38
ret

Function at 0x14000ff84
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x170
xor ebx, ebx
mov rdi, rcx
cmp qword [0x140016380], rbx
jne 0x14000ffd1
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, rbx
mov qword [0x140016380], rax
je 0x14000ffd1
lea rdx, str.SHGetSpecialFolderPathA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140016378], rax
jmp 0x14000ffd8
mov rax, qword [0x140016378]
cmp rax, rbx
je 0x14000fff9
call fcn.1400066d0
xor r9d, r9d
mov rdx, rdi
lea r8d, [r9 + 0x1a]
xor ecx, ecx
call qword [0x140016378]
jmp 0x1400100a7
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x60], bl
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x30]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x140010093
lea rdx, str.AppData
lea rcx, [rsp + 0x38]
call fcn.140010a1c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x198]
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x190], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140010a1c
cmp byte [rdi], bl
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rdi
ret
Function at 0x140010ab0
Capabilities:
Parse pe header
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
cmp word [0x140000000], 0x5a4d
je 0x140010aed
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x140000000]
jmp 0x140010b7b
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x140010b11
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140010b7b
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x140010b58
cmp ecx, 0x20b
je 0x140010b30
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140010b7b
cmp dword [rax + 0x84], 0xe
ja 0x140010b44
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140010b7b
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x140010b7b
cmp dword [rax + 0x74], 0xe
ja 0x140010b69
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140010b7b
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x1400165e8], 0xffffffffffffffff
mov qword [0x1400165f0], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x14001529c]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x140015298]
mov dword [rcx], eax
call fcn.140010d60
cmp dword [section..data], 0
jne 0x140010bd5
lea rcx, [fcn.140010d60]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x1400116e8]
lea rcx, [0x1400116e0]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x140015294]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x140015290]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x1400116d8]
lea rcx, [0x1400116a8]
call sub.msvcrt.dll__initterm
mov r11, qword [sym.imp.msvcrt.dll__acmdln]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x140010c76
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x140010c66
cmp al, 0x22
je 0x140010c66
jmp 0x140010c50
cmp byte [r8], 0x22
jne 0x140010c86
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140010c86
cmp byte [r8], 0x20
jbe 0x140010c86
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140010c76
movzx eax, byte [r8]
test al, al
je 0x140010c9c
cmp al, 0x20
ja 0x140010c9c
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140010c86
test byte [rsp + 0x8c], 1
je 0x140010cb1
movzx r9d, word [rsp + 0x90]
jmp 0x140010cb7
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.14000e51c
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x140010cd3
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x140010cf7
mov eax, edi
jmp 0x140010d00
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret