joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cbb0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rdx], 0
lea r8, [0x1400409ba]
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.14001fbf0
mov rbx, qword [rbx]
test rbx, rbx
je 0x14000ccc4
mov qword [rdi], 0
mov ecx, 0x820
call fcn.140021ee0
test rax, rax
je 0x14000ccfa
mov r14, rax
mov rcx, rbx
xor edx, edx
mov r8d, 2
call fcn.14001ba00
mov rcx, rbx
test eax, eax
je 0x14000cd04
call fcn.140021fa8
mov ecx, 2
call fcn.140016598
lea rcx, str.Warning:_MAR_size_could_not_be_determined_n
mov edx, 0x2a
mov r8d, 1
mov r9, rax
call fcn.140021a1c
mov r15d, 0x1f400000
mov rcx, r15
call fcn.140021ee0
mov qword [r14], rax
test rax, rax
je 0x14000cd56
mov rsi, rax
mov edx, 1
mov rcx, rax
mov r8, r15
mov r9, rbx
call fcn.140021758
mov qword [r14 + 8], rax
mov rcx, rbx
call fcn.140021448
cmp eax, 0xffffffff
je 0x14000cd89
mov ecx, 2
call fcn.140016598
lea rdx, str.ERROR:_File_is_larger_than_buffer___lli__n
mov rcx, rax
mov r8, r15
call fcn.140001260
mov rcx, rsi
jmp 0x14000cdbc
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_could_not_open_file_in_mar_wopen___n
mov edx, 0x2a
mov r8d, 1
mov r9, rax
call fcn.140021a1c
mov rcx, rsi
call fcn.14001fd3c
mov esi, 1
jmp 0x14000cdd8
mov esi, 2
jmp 0x14000cdce
call fcn.14001c618
mov rsi, rax
mov rcx, rbx
call fcn.140021fa8
test esi, esi
js 0x14000cc37
mov r15d, esi
cmp esi, 0x1f400001
jb 0x14000cc61
mov ecx, 2
call fcn.140016598
lea rdx, str.ERROR:_MAR_exceeds_maximum_size___lli__n
mov rcx, rax
mov r8, r15
call fcn.140001260
mov rcx, r14
call fcn.140021a08
mov esi, 3
jmp 0x14000cdce
mov esi, 2
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_MAR_buffer_could_not_be_allocated_n
mov edx, 0x29
mov r8d, 1
mov r9, rax
call fcn.140021a1c
mov rcx, r14
call fcn.140021a08
jmp 0x14000cdce
mov rcx, rbx
call fcn.140021170
test eax, eax
je 0x14000cdf3
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Failed_to_read_MAR_n
mov edx, 0x1a
mov r8d, 1
mov r9, rax
call fcn.140021a1c
mov rcx, qword [r14]
call fcn.140021a08
mov rcx, r14
call fcn.140021a08
mov esi, 1
mov rcx, qword [rsp + 0x20]
call fcn.140021088
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140024a50
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, r14
add rcx, 0x10
xor esi, esi
mov r8d, 0x80c
xor edx, edx
call fcn.140015da0
mov qword [rdi], r14
jmp 0x14000cdce
Function at 0x14000d5c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqa xmm7, xmmword [0x14003d810]
xor eax, eax
movdqa xmm1, xmmword [0x14003d820]
movdqa xmm8, xmmword [0x14003d830]
movdqa xmm9, xmmword [0x14003d840]
movdqa xmm10, xmmword [0x14003d850]
movdqa xmm11, xmmword [0x14003d860]
movdqa xmm12, xmmword [0x14003d870]
lea rcx, [0x14004b0b0]
movdqa xmm13, xmmword [0x14003d880]
movdqa xmm2, xmm7
psrld xmm2, 1
movdqa xmm0, xmm7
pslld xmm0, 0x1f
psrad xmm0, 0x1f
pand xmm0, xmm1
pxor xmm0, xmm2
movdqa xmm4, xmm0
psrld xmm4, 1
movdqa xmm2, xmm7
pslld xmm2, 0x1e
psrad xmm2, 0x1f
pand xmm2, xmm1
pxor xmm2, xmm4
movdqa xmm4, xmm2
psrld xmm4, 6
movdqa xmm3, xmm7
pslld xmm3, 0x1d
psrad xmm3, 0x1f
pand xmm3, xmm8
movdqa xmm5, xmm7
pslld xmm5, 0x1c
psrad xmm5, 0x1f
pand xmm5, xmm9
pxor xmm5, xmm3
movdqa xmm3, xmm7
pslld xmm3, 0x1b
psrad xmm3, 0x1f
pand xmm3, xmm10
movdqa xmm6, xmm7
pslld xmm6, 0x1a
psrad xmm6, 0x1f
pand xmm6, xmm11
pxor xmm6, xmm3
pxor xmm6, xmm5
pxor xmm6, xmm4
pslld xmm0, 0x1a
psrad xmm0, 0x1f
pand xmm0, xmm12
pslld xmm2, 0x1a
psrad xmm2, 0x1f
pand xmm2, xmm1
pxor xmm2, xmm6
pxor xmm2, xmm0
movdqa xmmword [rax + rcx], xmm2
paddd xmm7, xmm13
add rax, 0x10
cmp rax, 0x400
jne 0x14000d644
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x14000d760
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movdqa xmm0, xmmword [0x14003d890]
xor eax, eax
movdqa xmm1, xmmword [0x14003d8a0]
movdqa xmm2, xmmword [0x14003d8b0]
lea rcx, [0x14004b4b0]
movdqa xmm3, xmmword [0x14003d8c0]
movdqa xmm4, xmm0
psrlq xmm4, 1
movdqa xmm5, xmm0
psllq xmm5, 0x3f
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm5
psrlq xmm4, 1
movdqa xmm6, xmm0
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
movdqa xmm4, xmm6
psrlq xmm4, 1
psllq xmm5, 0x3e
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm5
psrlq xmm4, 1
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
movdqa xmm4, xmm6
psrlq xmm4, 1
psllq xmm5, 0x3e
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm5
psrlq xmm4, 1
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
movdqa xmm4, xmm6
psrlq xmm4, 2
psllq xmm5, 0x3e
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm2
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqa xmmword [rax + rcx], xmm6
paddq xmm0, xmm3
add rax, 0x10
cmp rax, 0x800
jne 0x14000d792
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x14000e340
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov r10, rcx
cmp dword [rcx], 4
jne 0x14000e360
mov rax, qword [r8]
sub r9, rax
cmp r9, 5
jae 0x14000e367
xor esi, esi
jmp 0x14000e4d8
add rdx, rax
mov r12d, dword [r10 + 0x10]
add r9, 0xfffffffffffffffc
mov rax, 0xffffffffffffffff
xor esi, esi
lea r15, [0x14003d930]
mov r14d, 0xe8
mov cl, byte [rdx + rsi]
and cl, 0xfe
cmp cl, 0xe8
jne 0x14000e3a4
mov rcx, rsi
sub rcx, rax
cmp rcx, 3
jbe 0x14000e3ac
xor r12d, r12d
jmp 0x14000e3e6
mov rcx, rsi
jmp 0x14000e4af
dec cl
shl r12d, cl
mov eax, r12d
mov r12d, 0
and eax, 7
je 0x14000e3e6
bt r14d, eax
jb 0x14000e4a2
movzx ecx, byte [rax + r15]
mov rdi, rsi
sub rdi, rcx
mov cl, byte [rdi + rdx + 4]
dec cl
cmp cl, 0xfe
jae 0x14000e4a2
mov r12d, eax
movzx ebx, byte [rdx + rsi + 4]
lea eax, [rbx - 1]
cmp al, 0xfe
jae 0x14000e3fd
add r12d, r12d
inc r12d
jmp 0x14000e4a9
movzx eax, byte [rdx + rsi + 1]
movzx ecx, byte [rdx + rsi + 2]
shl ecx, 8
movzx ebp, byte [rdx + rsi + 3]
shl ebp, 0x10
shl ebx, 0x18
or ebx, eax
or ebx, ecx
or ebx, ebp
mov eax, dword [r10 + 0xc]
add eax, esi
mov r13d, 0xfffffffb
sub r13d, eax
add ebx, r13d
test r12d, r12d
je 0x14000e478
mov eax, r12d
movzx r11d, byte [rax + r15]
shl r11d, 3
mov eax, 0x18
sub eax, r11d
mov ebp, ebx
mov ecx, eax
shr ebp, cl
dec bpl
cmp bpl, 0xfe
jb 0x14000e478
neg r11b
mov ebp, 0xffffffff
mov ecx, r11d
shl ebp, cl
xor ebx, ebp
not ebx
add ebx, r13d
mov edi, ebx
mov ecx, eax
shr edi, cl
dec dil
cmp dil, 0xfd
ja 0x14000e462
lea rcx, [rsi + 4]
mov eax, ebx
and eax, 0x1000000
mov ebp, eax
neg ebp
or ebp, eax
mov byte [rdx + rsi + 1], bl
mov byte [rdx + rsi + 2], bh
shr ebx, 0x10
mov byte [rdx + rsi + 3], bl
shr ebp, 0x18
mov byte [rdx + rsi + 4], bpl
jmp 0x14000e4ac
lea r12d, [rax + rax]
inc r12d
mov rcx, rsi
mov rax, rsi
mov rsi, rcx
inc rsi
cmp rsi, r9
jb 0x14000e388
mov rdx, rsi
sub rdx, rax
lea ecx, [rdx - 1]
shl r12d, cl
xor eax, eax
cmp rdx, 4
cmovb eax, r12d
mov dword [r10 + 0x10], eax
add qword [r8], rsi
add dword [r10 + 0xc], esi
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140011750
Capabilities:
Get token privileges

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400117c5
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0x2c]
mov edx, 0x12
mov r8, rsi
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
setne al
cmp dword [rsi], 3
sete sil
and sil, al
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400117c7
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140024a50
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x140011960
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp qword [rcx], 0
je 0x1400119ef
mov r14, rdx
mov rsi, rcx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov r9, qword [rcx]
lea rcx, str._Warning:
mov edx, ntohl
mov r8d, 1
call fcn.140021a1c
mov rdi, qword [rsp + 0x28]
mov rbx, qword [rsi]
call fcn.140001080
mov rcx, qword [rax]
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov r8, r14
xor r9d, r9d
call fcn.1400139fc
mov r9, qword [rsi]
lea rcx, str._n
mov edx, 4
mov r8d, 1
call fcn.140021a1c
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140024a50
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400120f0
Capabilities:
Create directory
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x140037028]
xor esi, esi
lea r9, [rsp + 0x20]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x140012146
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.1400138d0
cmp rax, 0x105
jb 0x14001215d
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140024a50
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8d, 0x105
mov rcx, rdi
mov rdx, rbx
call fcn.140013a90
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.Mozilla_Maintenance_Service
mov rcx, rdi
call fcn.140035cb0
test eax, eax
je 0x140012146
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400121aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140012146
lea rdx, str.UpdateLogs
mov rcx, rdi
call fcn.140035cb0
test eax, eax
je 0x140012146
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400121df
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140012146
mov esi, 1
jmp 0x140012146
Function at 0x1400128e0
Capabilities:
Query service status

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
xor edx, edx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x1400129dc
mov r14, rax
mov rcx, rax
mov rdx, rdi
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x140012a02
mov rdi, rax
mov dword [rsp + 0x3c], 0xcf
imul ebp, ebx, 0x3e8
test ebp, ebp
je 0x140012a2c
xor esi, esi
lea r15, [rsp + 0x34]
lea r12, [rsp + 0x38]
mov rbx, qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r15
mov rcx, rdi
xor edx, edx
mov r8, r12
mov r9d, 0x24
call rbx
test eax, eax
je 0x140012993
cmp dword [rsp + 0x3c], 1
jne 0x1400129c4
jmp 0x140012a4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jle 0x1400129b0
lea ecx, [rax - 0x425]
cmp ecx, 2
jb 0x1400129c4
jmp 0x140012a9e
cmp eax, 0x79
jle 0x140012a54
cmp eax, 0x41c
jne 0x140012a7f
mov ecx, 0x32
call r13
add esi, 0x32
cmp esi, ebp
jb 0x14001296e
mov ebx, dword [rsp + 0x3c]
jmp 0x140012abc
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x429
sete cl
xor ecx, 0xff
cmp eax, 5
mov ebx, 0xfd
cmovne ebx, ecx
jmp 0x140012acd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, 0x7a
jg 0x140012a36
cmp edi, 5
je 0x140012a6a
cmp edi, 6
jne 0x140012a78
mov ebx, 0xec
jmp 0x140012acd
mov ebx, 0xcf
jmp 0x140012abc
cmp edi, 0x7b
je 0x140012a71
cmp edi, 0x424
jne 0x140012a78
mov ebx, 0xee
jmp 0x140012acd
mov ebx, 1
jmp 0x140012abc
cmp eax, 5
je 0x140012a90
cmp eax, 6
je 0x140012a97
cmp eax, 0x57
jne 0x140012aac
mov ebx, 0xdc
jmp 0x140012ab8
mov ebx, 0xeb
jmp 0x140012acd
mov ebx, 0xed
jmp 0x140012acd
mov ebx, 0xef
jmp 0x140012acd
cmp eax, 0x7a
je 0x140012ab3
cmp eax, 0x7c
jne 0x140012aac
mov ebx, 0xdd
jmp 0x140012ab8
mov ebx, 0xda
jmp 0x140012ab8
mov ebx, 0xd9
jmp 0x140012ab8
cmp eax, 0x45b
jne 0x140012aac
mov ebx, 0xde
jmp 0x140012ab8
mov ebx, 0xdf
jmp 0x140012ab8
mov ebx, 0xdb
mov dword [rsp + 0x3c], ebx
mov rsi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call rsi
mov rcx, r14
call rsi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140024a50
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140012af0
Capabilities:
Start service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rdx
mov ebp, ecx
lea r15d, [rbp + 2]
movsxd rax, r15d
mov ecx, 8
mul rcx
mov rcx, 0xffffffffffffffff
cmovno rcx, rax
call fcn.1400137e4
mov rsi, rax
lea rax, str.MozillaMaintenance
mov qword [rsi], rax
lea rax, str.software_update
mov qword [rsi + 8], rax
test ebp, ebp
jle 0x140012b53
lea rcx, [rsi + 0x10]
mov r8d, ebp
shl r8, 3
mov rdx, rbx
call fcn.1400288a0
lea rcx, str.MozillaMaintenance
mov edx, 5
call fcn.1400128e0
cmp eax, 1
jne 0x140012be8
xor ecx, ecx
xor edx, edx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x140012bf2
mov rdi, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 0x10
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x140012bf9
mov rbx, rax
mov qword [rsp + 0x20], rdi
mov edi, 0xffffff9c
mov r12, qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
mov edx, r15d
mov r8, rsi
call r12
test eax, eax
jne 0x140012c09
call r13
mov ebp, eax
mov ecx, 0x64
call r14
add edi, 0x64
cmp edi, 0x1324
jb 0x140012bbe
jmp 0x140012c0b
mov ebp, eax
add ebp, 0x4e20
jmp 0x140012c23
mov ebp, 0x4269
jmp 0x140012c23
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, 0x426a
jmp 0x140012c23
xor ebp, ebp
mov rdi, qword [rsp + 0x20]
mov r14, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call r14
mov rcx, rdi
call r14
mov rcx, rsi
call fcn.140013a88
mov eax, ebp
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140012c40
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x238], rax
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
xor edx, edx
call fcn.140015da0
mov rcx, rdi
call fcn.1400138d0
cmp rax, 0x104
ja 0x140012cbd
lea rbx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
mov rdx, rdi
call fcn.140013a90
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 3
sete cl
mov dword [rsi], ecx
mov ebx, 1
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.140024a50
mov eax, ebx
add rsp, 0x240
pop rbx
pop rdi
pop rsi
ret
Function at 0x140012ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
call fcn.140011750
test al, al
je 0x140012dcf
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
xor edi, edi
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140012dcf
mov rcx, qword [rsp + 0x38]
lea rbx, [rsp + 0x44]
mov dword [rbx], 4
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, str.ConsentPromptBehaviorAdmin
xor edi, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x140012d7e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140012dcf
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rdx, str.PromptOnSecureDesktop
xor edi, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140012dcf
mov eax, dword [rsp + 0x34]
xor ecx, ecx
or eax, dword [rsp + 0x30]
sete cl
mov dword [rsi], ecx
mov edi, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140024a50
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x14001fe28
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001fe48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001b634
or eax, 0xffffffff
jmp 0x14001fe4a
xor eax, eax
add rsp, 0x28
ret

Function at 0x14001fe80
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14001fea0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001b634
or eax, 0xffffffff
jmp 0x14001fea2
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400357e0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x118
mov rdi, r9
mov r12, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x110], rax
lea rsi, [rsp + 0x78]
mov rcx, rsi
call fcn.140001090
mov rsi, qword [rsi]
test rsi, rsi
je 0x14003595b
lea r14, [rsp + 0x60]
mov dword [r14], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ebx, ebx
mov rcx, rax
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
test eax, eax
je 0x1400358a2
cmp dword [rsp + 0x60], 0
je 0x1400358a2
xor ebx, ebx
lea r15, [rsp + 0x80]
mov r8d, 0x90
mov rcx, r15
xor edx, edx
call fcn.140015da0
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 9
mov r8, r15
mov r9d, 0x90
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x1400358a2
mov eax, dword [rsp + 0x90]
bt eax, 0xd
jae 0x1400358a2
shl eax, 0xd
and eax, 0x1000000
mov ebx, eax
xorps xmm0, xmm0
lea rax, [rsp + 0x80]
movaps xmmword [rax], xmm0
movaps xmmword [rax + 0x10], xmm0
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
xor ecx, ecx
mov qword [rax + 0x60], rcx
mov dword [rax], 0x68
lea rdx, str.winsta0Default
mov qword [rax + 0x10], rdx
mov qword [rsp + 0x70], rcx
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0
mov rcx, r12
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
je 0x140035967
mov rcx, qword [rsp + 0x60]
test rdi, rdi
je 0x14003595f
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140013a88
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140024a50
mov eax, ebx
add rsp, 0x118
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x140035938
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140035925
xor r14d, r14d
lea rdi, [rsp + 0x58]
mov qword [rdi], r14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 0
mov ecx, 0x1300
xor edx, edx
mov r8d, eax
mov r9d, 0x400
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rax, qword [rdi]
test rax, rax
lea rdx, [0x140040b0c]
cmovne rdx, rax
call fcn.1400359d0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140035930
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140035930
Function at 0x140035bf0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push rsi
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x278], rax
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x140035c64
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140035c96
lea rdx, [rsp + 0x54]
lea rsi, [0x14004bcb0]
mov r8d, 0x105
mov rcx, rsi
call fcn.140013a90
mov word [0x14004beb8], 0
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140024a50
mov rax, rsi
add rsp, 0x280
pop rsi
ret
lea rcx, [rsi + 8]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
jne 0x140035c25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.14001b5f4
cmp esi, 2
je 0x140035ca6
mov dword [rax], 9
jmp 0x140035cac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x140035cac
call fcn.14001b5f4
mov dword [rax], 2
xor esi, esi
jmp 0x140035c48
Function at 0x2fc4ce080
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4cf160
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4cea82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f1108]
test eax, eax
je 0x2fc4ceb1a
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f1110]
mov qword [rbp - 8], rax
jmp 0x2fc4ceafe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4ceaf2
cmp qword [rbp - 0x10], 0
je 0x2fc4ceaf2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4ceab8
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4ceb1b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cec20
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cec48
mov eax, 0
jmp 0x2fc4cec96
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cec71
mov eax, 0
jmp 0x2fc4cec96
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cec91
mov eax, 0
jmp 0x2fc4cec96
mov eax, 1
add rsp, 0x20
pop rbp
ret