joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180089430
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor eax, eax
test eax, eax
jne 0x18008943e
xor eax, eax
test eax, eax
jne 0x18008943e
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rsp, 0x28
ret

Function at 0x180089470
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor eax, eax
test eax, eax
jne 0x18008947e
xor eax, eax
test eax, eax
jne 0x18008947e
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add rsp, 0x28
ret

Function at 0x180089570
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov rax, qword [0x1801837f8]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x50]
call fcn.180056e20
mov r11, qword [rsp + 0x2a0]
mov r9d, dword [r11 + 8]
or r9d, 0x2001f
mov r8, qword [rsp + 0x2a8]
mov rdx, qword [rsp + 0x2a0]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x50]
call fcn.180056ec0
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x1800895f9
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x270], eax
lea rcx, [rsp + 0x50]
call fcn.180056e50
mov eax, dword [rsp + 0x270]
jmp 0x1800896bd
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180089686
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.180089570
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x180089679
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x274], eax
lea rcx, [rsp + 0x50]
call fcn.180056e50
mov eax, dword [rsp + 0x274]
jmp 0x1800896bd
mov dword [rsp + 0x40], 0x100
jmp 0x180089601
lea rcx, [rsp + 0x50]
call fcn.180056e70
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call fcn.180089430
mov dword [rsp + 0x278], eax
lea rcx, [rsp + 0x50]
call fcn.180056e50
mov eax, dword [rsp + 0x278]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18008cb70
add rsp, 0x298
ret
Function at 0x180089c70
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
test eax, eax
jne 0x180089c83
xor eax, eax
test eax, eax
jne 0x180089c83
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x180089cd0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x180089ce8
xor eax, eax
test eax, eax
jne 0x180089ce8
cmp qword [rsp + 0x60], 0
je 0x180089d06
mov dword [rsp + 0x34], 1
jmp 0x180089d0e
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x180089d24
mov eax, 0xd
jmp 0x180089d66
xor eax, eax
test eax, eax
jne 0x180089cf4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x48
ret

Function at 0x180089d70
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
jne 0x180089d83
xor eax, eax
test eax, eax
jne 0x180089d83
cmp qword [rsp + 0x70], 0
je 0x180089da1
mov dword [rsp + 0x48], 1
jmp 0x180089da9
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x180089dc2
mov eax, 0xd
jmp 0x180089e43
xor eax, eax
test eax, eax
jne 0x180089d8f
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [rsp + 0x40], eax
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
lea rax, [rax + rcx*2]
mov qword [rsp + 0x38], rax
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x30]
lea rax, [rax + rcx*2]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x40], 1
jne 0x180089dda
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x58
ret
Function at 0x18008c114
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x180184ee8]
test rcx, rcx
jne 0x18008c063
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x18008c05c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18008c08e
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x18008c058
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x180184ee8], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x18008c101
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18008c0b1
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], 0x20
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x180184ee8]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x18008c0de
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x18008c101
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x180184ee8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x18008c0e5
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x18008bfe8
Function at 0x180091213
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1801837f8]
jne 0x18008cb8a
rol rcx, 0x10
test cx, 0xffff
jne 0x18008cb86
repz ret
ror rcx, 0x10
jmp 0x18009116c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180185030]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180185128]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800911f1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180185030]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180091213
mov rax, qword [rsp + 0x88]
mov qword [0x180185128], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1801850c8], rax
mov rax, qword [0x180185128]
mov qword [0x180184fa0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1801850b0], rax
mov dword [0x180184f90], 0xc0000409
mov dword [0x180184f94], 1
mov rax, qword [0x1801837f8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180183800]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180185028], eax
mov ecx, 1
call fcn.18009ff28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800b1b60]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180185028], 0
jne 0x18009129a
mov ecx, 1
call fcn.18009ff28
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180091c04
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180091a6c
Function at 0x1800a0598
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180090744
xor ebx, ebx
mov rdi, rax
cmp qword [0x180185cc8], rbx
jne 0x1800a069e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800a0773
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800a0773
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1800b44b8]
mov rcx, rsi
mov qword [0x180185cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180185cd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x180185cd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x180185ce8], rax
test rax, rax
je 0x1800a0695
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180185ce0], rax
jmp 0x1800a06a5
mov rax, qword [0x180185ce0]
jmp 0x1800a06ac
mov rax, qword [0x180185ce0]
mov r11, qword [0x180185ce8]
cmp rax, rdi
je 0x1800a0714
cmp r11, rdi
je 0x1800a0714
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x180185ce8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1800a0714
test rax, rax
je 0x1800a0714
call rsi
test rax, rax
je 0x1800a070e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800a070e
test byte [rsp + 0x38], 1
jne 0x1800a0714
bts ebp, 0x15
jmp 0x1800a0752
mov rcx, qword [0x180185cd0]
cmp rcx, rdi
je 0x1800a0752
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800a0752
call rax
mov rbx, rax
test rax, rax
je 0x1800a0752
mov rcx, qword [0x180185cd8]
cmp rcx, rdi
je 0x1800a0752
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800a0752
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180185cc8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800a0773
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800a0775
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14162f100
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14162f10d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14162f11d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14162f105
lea eax, [rcx + 1]
jmp 0x14162f12b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14162f13e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14162f124
sub eax, 3
jb 0x14162f15e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14162f1ad
sar eax, 1
movsxd rbp, eax
jb 0x14162f194
jmp 0x14162f16c
add ebx, ebx
jne 0x14162f16a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14162f194
inc ecx
add ebx, ebx
jne 0x14162f17a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14162f194
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14162f18d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14162f17c
add ecx, 2
jmp 0x14162f199
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14162f0c2
jmp 0x14162f10d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x1621000]
mov eax, dword [rdi]
or eax, eax
je 0x14162f219
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x164825c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14162f1bd
jns 0x14162f1f2
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14162f1fc
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14162f213
mov qword [rbx], rax
add rbx, 8
jmp 0x14162f1dd
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14162f25d
cmp al, 0xef
ja 0x14162f245
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14162f225
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14162f234
mov eax, dword [rdi]
add rdi, 4
jmp 0x14162f234
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x26f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14162f2b1
sub rsp, 0xffffffffffffff80
jmp 0x140b2360c
Function at 0x140001858
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push rbx
sub rsp, 0x30
mov ecx, dword [0x140028050]
mov ebx, 0x80000000
lea eax, [rcx + rbx]
test ebx, eax
jne 0x14000189d
cmp ecx, 0x80010106
je 0x14000189d
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [0x140028050], eax
lea ecx, [rax + rbx]
test ebx, ecx
jne 0x14000189d
cmp eax, 0x80010106
je 0x14000189d
xor eax, eax
jmp 0x1400018e8
cmp qword [0x14002ce58], 0
mov ebx, 1
jne 0x1400018e6
lea rax, [0x14002ce58]
mov r8d, ebx
lea r9, [0x14001a250]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x14001a300]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400018df
cmp qword [0x14002ce58], 0
jne 0x1400018e6
call fcn.1400018f0
jmp 0x140001899
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x14000326c
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x140028010]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov edi, 0x400
lea rcx, [rsp + 0x40]
mov r8d, edi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xor ebx, ebx
cmp dword [0x14002cf18], ebx
je 0x1400032b4
mov eax, dword [0x14002bfa8]
jmp 0x140003372
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x14000334b
lea r8, [0x14001a3b4]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [0x14001a3b8]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r8, str._appsafecheck.txt
mov rdx, rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x40]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140028070], rax
call fcn.1400031fc
mov edi, 1
test eax, eax
je 0x140003364
call fcn.140003078
test eax, eax
je 0x140003364
mov ebx, edi
mov dword [0x14002bfa8], ebx
mov eax, ebx
mov dword [0x14002cf18], edi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140015a80
mov rbx, qword [rsp + 0x460]
add rsp, 0x450
pop rdi
ret

Function at 0x140003394
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rdi, rcx
test rcx, rcx
je 0x1400033f9
mov rcx, qword [0x140028070]
or rbx, 0xffffffffffffffff
cmp rcx, rbx
je 0x1400033f9
lea r9d, [rsi + 2]
mov dword [rsp + 0x40], esi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
inc rbx
cmp word [rdi + rbx*2], si
jne 0x1400033d0
mov rcx, qword [0x140028070]
lea r8d, [rbx + rbx]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400033fb
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000340c
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x140028010]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rdx
mov rsi, rcx
or r13, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x250
mov r15, r13
call sub.VCRUNTIME140.dll_memset
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov ebp, r12d
test rsi, rsi
je 0x1400035e6
mov rax, r13
inc rax
cmp word [rsi + rax*2], r12w
jne 0x14000346b
test rax, rax
je 0x1400035e6
test rbx, rbx
je 0x1400035e6
mov dword [rbx], r12d
call fcn.140003138
test eax, eax
jne 0x1400035d9
call fcn.14000326c
test eax, eax
je 0x1400035d9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400034d9
mov ecx, 0x410
and eax, ecx
cmp eax, ecx
jne 0x1400034d9
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140003934
test eax, eax
jne 0x1400034d9
mov dword [rbx], 1
jmp 0x1400035d9
mov r9, r13
lea r8, [0x14001a128]
mov rdx, r13
mov rcx, rsi
call fcn.1400028ac
mov r14, rax
test rax, rax
jne 0x1400034ff
lea eax, [r14 + 0xe]
jmp 0x1400035eb
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, r13
jne 0x140003522
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x1400035c5
test byte [rsp + 0x30], 0x10
je 0x14000359a
lea rdx, [0x14001a3a8]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000359a
lea rdx, [0x14001a3ac]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000359a
mov r9, r13
lea r8, [rsp + 0x5c]
mov rdx, r13
mov rcx, rsi
call fcn.1400028ac
mov rdi, rax
test rax, rax
je 0x14000359a
mov rdx, rbx
mov rcx, rax
call fcn.14000340c
mov ebp, eax
test eax, eax
jne 0x140003586
cmp dword [rbx], r12d
jne 0x1400035b1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400035c5
jmp 0x140003522
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebp
jmp 0x1400035eb
mov eax, 0x57
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140015a80
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006970
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x4e70
call fcn.140016e10
sub rsp, rax
mov rax, qword [0x140028010]
xor rax, rsp
mov qword [rsp + 0x4e60], rax
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x3e80
call sub.VCRUNTIME140.dll_memset
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
mov r8d, 0x3e80
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x140006a86
lea rax, [rsp + 0x3ec0]
mov dword [rsp + 0x2c], ebx
mov qword [rsp + 0x30], rax
mov edi, 0xfa0
mov eax, dword [rsp + 0x20]
mov word [rsp + 0x2a], di
test rax, 0xfffffffffffffff8
jbe 0x140006a7f
nop
mov r8, rdi
lea rcx, [rsp + 0x3ec0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + rbx*8 + 0x40]
lea rdx, [rsp + 0x3ec0]
mov r8d, 0x7cf
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x3ec0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006a40
mov r8, qword [rsp + rbx*8 + 0x40]
lea rdx, [rsp + 0x28]
add ax, ax
lea rcx, [0x140028080]
xor r9d, r9d
mov word [rsp + 0x28], ax
call fcn.140006ab0
test eax, eax
je 0x140006a86
mov eax, dword [rsp + 0x20]
inc rbx
shr rax, 3
cmp rbx, rax
jb 0x140006a00
mov eax, 1
jmp 0x140006a88
xor eax, eax
mov rcx, qword [rsp + 0x4e60]
xor rcx, rsp
call fcn.140015a80
mov rbx, qword [rsp + 0x4e80]
add rsp, 0x4e70
pop rdi
ret
Function at 0x1400075d0
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x14000782c
push rdi
sub rsp, 0x90
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x30]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.PSAPI.DLL_GetModuleInformation]
test eax, eax
je 0x140007824
mov eax, 0x5a4d
mov qword [rsp + 0x80], r15
mov r15d, dword [rsp + 0x38]
cmp word [rdi], ax
jne 0x14000781c
movsxd rcx, dword [rdi + 0x3c]
lea rax, [rcx + 0x108]
cmp rax, r15
jae 0x14000781c
cmp dword [rcx + rdi], 0x4550
mov qword [rsp + 0xb0], rbp
lea rbp, [rcx + rdi]
jne 0x140007814
movzx eax, word [rbp + 4]
mov ecx, 0x14c
mov qword [rsp + 0xb8], rsi
xor esi, esi
mov qword [rsp + 0x88], r14
cmp cx, ax
jne 0x140007685
xor r14d, r14d
jmp 0x1400076b7
mov ecx, 0x200
mov r8d, 0xaa64
cmp cx, ax
je 0x1400076a9
mov ecx, 0x8664
cmp cx, ax
je 0x1400076a9
cmp r8w, ax
jne 0x140007804
cmp r8w, ax
mov r14d, 1
sete sil
mov qword [rsp + 0xa8], rbx
mov ebx, dword [rbp + 0x28]
add rbx, rdi
je 0x1400077fc
cmp rbx, rdi
jbe 0x1400077fc
lea rax, [r15 + rdi]
cmp rbx, rax
jae 0x1400077fc
xorps xmm0, xmm0
lea rdx, [rsp + 0x48]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400077fc
test dword [rsp + 0x68], 0x1000
je 0x1400077fc
test dword [rsp + 0x70], 0x1000000
je 0x1400077fc
mov eax, dword [rsp + 0x6c]
xor ecx, ecx
test al, 0x10
jne 0x140007742
test al, 0x20
jne 0x140007742
test al, 0x40
jne 0x140007742
test al, al
jns 0x140007747
mov ecx, 1
test ecx, ecx
je 0x1400077fc
mov r9d, r14d
mov dword [rsp + 0x20], esi
mov r8d, r15d
mov rdx, rdi
mov rcx, rbp
call fcn.1400082b0
mov edx, 0x14
mov dword [rsp + 0xa0], 0
lea r9, [rsp + 0xa0]
mov rcx, rbx
lea r8d, [rdx + 0x2c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400077fc
test r14d, r14d
jne 0x1400077a6
mov eax, dword [0x140028060]
mov dword [rbx], eax
movzx eax, byte [0x140028064]
mov byte [rbx + 4], al
jmp 0x1400077ca
test esi, esi
je 0x1400077b6
mov rax, qword [0x140028058]
mov qword [rbx], rax
jmp 0x1400077ca
movzx eax, word [0x140028068]
mov word [rbx], ax
movzx eax, byte [0x14002806a]
mov byte [rbx + 2], al
mov r8d, dword [rsp + 0xa0]
lea r9, [rsp + 0xa0]
mov edx, 0x14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb8]
mov r14, qword [rsp + 0x88]
mov rbp, qword [rsp + 0xb0]
mov r15, qword [rsp + 0x80]
add rsp, 0x90
pop rdi
ret