joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400600f0
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x2e0
mov rbx, rcx
xor r12d, r12d
lea rcx, [rsp + 0x58]
mov rsi, r9
mov rbp, r8
mov rdi, rdx
mov qword [rsp + 0x30], r12
mov qword [rax + 0x20], r12
call fcn.140008640
lea rcx, [rsp + 0x38]
call fcn.140008640
lea rcx, [rsp + 0x78]
call fcn.140008640
lea rdx, str.SOFTWAREClasses_
lea rcx, [rsp + 0x58]
call fcn.140011cb0
lea rcx, [rsp + 0x58]
mov rdx, rbx
call fcn.1400121b0
lea rdx, [0x14009ca30]
lea rcx, [rsp + 0x58]
call fcn.1400121b0
lea rdx, [0x140096618]
lea rcx, [rsp + 0x38]
call fcn.140011cb0
cmp rdi, r12
je 0x1400601ac
cmp word [rdi], 0x5c
je 0x1400601ac
cmp word [rdi + 2], 0x5c
je 0x1400601ac
lea rdx, [0x14009ca40]
lea rcx, [rsp + 0x38]
call fcn.140011cb0
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.1400121b0
cmp rsi, r12
je 0x14006021f
xor edx, edx
lea rcx, [rsp + 0x98]
lea r8d, [rdx + 0x30]
call fcn.140018a40
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x9c], r12d
call fcn.140013690
lea rdx, str.IPC_
lea rcx, [rsp + 0x78]
call fcn.1400121b0
mov r11, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x320]
lea rcx, [rsp + 0x98]
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0xb0], r11
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
cmp eax, r12d
jne 0x14006030c
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov edi, eax
cmp eax, r12d
jne 0x14006030c
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x318]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r12d
jne 0x140060301
mov rcx, qword [rsp + 0x318]
lea rax, [rsp + 0x308]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x308], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
jne 0x1400602f3
mov eax, dword [rsp + 0x308]
lea rcx, [rsp + 0xd0]
shr eax, 1
mov dword [rsp + 0x308], eax
mov word [rsp + rax*2 + 0xd0], r12w
call fcn.140015940
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov rcx, rbx
mov edi, eax
call fcn.1400185f4
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x78]
call fcn.1400036e0
lea rcx, [rsp + 0x38]
call fcn.1400036e0
lea rcx, [rsp + 0x58]
call fcn.1400036e0
lea r11, [rsp + 0x2e0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140060350
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x290
mov rsi, rcx
lea rcx, [rsp + 0x40]
movaps xmmword [rax - 0x28], xmm6
mov rbp, rdx
call fcn.140008640
lea rdx, [rsp + 0x38]
movsd xmm6, qword [0x14009e8d0]
mov rcx, rsi
call qword [sym.imp.ole32.dll_StringFromIID]
xor r12d, r12d
cmp eax, r12d
mov edi, eax
jl 0x140060573
mov rcx, qword [rsp + 0x38]
call fcn.140015940
lea rdx, str.interface_
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.140011cb0
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.1400121b0
lea rdx, str.TypeLib
lea rcx, [rsp + 0x40]
call fcn.1400121b0
mov rcx, rbx
call fcn.1400185f4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rsp + 0x40]
lea r11, [rsp + 0x2c8]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r12d
jne 0x140060573
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x2c0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x2c0], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
jne 0x140060565
mov eax, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x70]
shr eax, 1
mov dword [rsp + 0x2c0], eax
mov word [rsp + rax*2 + 0x70], r12w
call fcn.140015940
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov rcx, rbx
mov edi, eax
call fcn.1400185f4
cmp edi, r12d
jl 0x140060565
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x2c0]
lea rdx, [0x14009c9f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x2c0], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x14006050d
mov eax, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x70]
shr eax, 1
mov dword [rsp + 0x2c0], eax
mov word [rsp + rax*2 + 0x70], r12w
call fcn.140019b44
movapd xmm6, xmm0
movsd xmm1, qword [0x14009e8d0]
movapd xmm0, xmm6
call fcn.14001d450
lea rax, [rsp + 0x30]
cvttsd2si rdx, xmm6
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
cvttsd2si r8, xmm0
call qword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
cmp eax, r12d
mov edi, eax
jl 0x140060565
mov rcx, qword [rsp + 0x30]
mov r8, rbp
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
mov edi, eax
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.1400036e0
lea r11, [rsp + 0x290]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400605a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x2d0
mov rsi, rcx
lea rcx, [rsp + 0x48]
xor r12d, r12d
mov rbp, rdx
mov ebx, 0x80004002
mov dword [rax + 0x18], SafeArrayCreateEx
mov edi, r12d
call fcn.140008640
lea r11, [rsp + 0x40]
lea rdx, str.interface
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x140060750
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x300]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x70]
mov edx, edi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, r12d
jne 0x140060745
mov eax, dword [rsp + 0x300]
lea rdx, str.interface_
lea rcx, [rsp + 0x48]
mov word [rsp + rax*2 + 0x70], r12w
mov dword [rsp + 0x300], 0x1fe
call fcn.140011cb0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400121b0
mov rdx, qword [rsp + 0x48]
lea r11, [rsp + 0x308]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x14006072e
mov rcx, qword [rsp + 0x308]
lea rax, [rsp + 0x300]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x140060720
mov eax, dword [rsp + 0x300]
lea rcx, [rsp + 0xc0]
mov rdx, rbp
shr eax, 1
mov dword [rsp + 0x300], eax
mov word [rsp + rax*2 + 0xc0], r12w
call fcn.140018060
cmp eax, r12d
jne 0x140060720
lea rcx, [rsp + 0x70]
mov rdx, rsi
call qword [sym.imp.ole32.dll_IIDFromString]
mov ebx, eax
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r12d
je 0x140060745
inc edi
mov dword [rsp + 0x300], SafeArrayCreateEx
jmp 0x140060608
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x48]
call fcn.1400036e0
lea r11, [rsp + 0x2d0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140061650
Capabilities:
Create http request

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x90
mov rax, qword [rcx + 0x158]
mov esi, dword [rcx + 0x148]
mov rdi, r8
mov r8, qword [rcx + 0x150]
mov qword [r11 - 0x40], rax
mov rax, qword [rcx + 0x160]
mov qword [r11 - 0x38], rax
mov rax, qword [rcx + 0x168]
mov rbx, rcx
inc dword [rax]
mov rbp, qword [rcx + 0x178]
mov r12, qword [rcx + 0x170]
mov qword [r11 - 0x30], rax
mov rax, qword [rcx + 0x180]
mov qword [r11 - 0x48], r8
mov qword [r11 - 0x58], rax
mov rax, qword [rcx + 0x188]
mov qword [r11 - 0x60], rbp
inc dword [rax]
mov r13, qword [rcx + 0x198]
mov r14, qword [rcx + 0x190]
mov qword [r11 - 0x50], rax
mov rax, qword [rcx + 0x1a0]
mov qword [r11 - 0x80], r13
mov qword [r11 - 0x78], rax
mov rax, qword [rcx + 0x1a8]
mov qword [rsp + 0x30], r14
inc dword [rax]
mov qword [r11 - 0x68], r12
mov qword [r11 - 0x70], rax
cmp edx, 1
jne 0x140061757
mov esi, dword [rcx + 0x1b0]
lea rdx, [rcx + 0x1b8]
lea rcx, [r11 - 0x48]
call fcn.140013690
lea rdx, [rbx + 0x1d8]
lea rcx, [rsp + 0x50]
call fcn.140013690
lea rdx, [rbx + 0x1f8]
lea rcx, [rsp + 0x30]
call fcn.140013690
mov r8, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov r13, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
cmp esi, 1
jne 0x140061760
mov edx, esi
jmp 0x140061773
cmp esi, 2
jne 0x140061771
lea r9, str._local_
lea edx, [rsi + 1]
jmp 0x140061779
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea rcx, [0x1400965b0]
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rdi], rax
cmp rax, rbx
je 0x1400617ef
lea r9d, [rbx + 8]
lea r8, [rsp + 0xc0]
lea edx, [rbx + 0x32]
xor ecx, ecx
mov dword [rsp + 0xc0], 1
mov dword [rsp + 0xc4], ebx
call qword [sym.imp.WININET.dll_InternetSetOptionW]
cmp esi, 2
jne 0x1400617ed
cmp rbp, rbx
je 0x1400617ed
mov rcx, qword [rdi]
lea r9d, [rbp + 1]
lea edx, [rbx + 0x2b]
mov r8, r12
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov rcx, qword [rdi]
lea r9d, [r13 + 1]
lea edx, [rbx + 0x2c]
mov r8, r14
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov bl, 1
lea rcx, [rsp + 0x30]
call fcn.1400036e0
lea rcx, [rsp + 0x50]
call fcn.1400036e0
lea rcx, [rsp + 0x70]
call fcn.1400036e0
lea r11, [rsp + 0x90]
mov al, bl
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140061e50
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x2e0
lea rcx, [rsp + 0x48]
call fcn.1400022f0
mov rax, qword [rsp + 0x58]
mov r11, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x48]
lea rdx, [0x14009bfd0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
inc dword [rax]
mov qword [rsp + 0x70], r11
mov qword [rsp + 0x80], rax
call fcn.1400121b0
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x90]
mov bl, 1
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x140062025
mov bpl, byte [rsp + 0x330]
mov sil, byte [rsp + 0x328]
mov rdi, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x300]
call fcn.14003f890
cmp eax, 1
je 0x14006201e
cmp eax, 0xb
jne 0x140061f17
lea ecx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140061ef1
lea rdx, [0x140098e4c]
lea rcx, [rsp + 0xbc]
call fcn.140018ccc
test eax, eax
je 0x140062001
lea rdx, [0x14009bfd8]
lea rcx, [rsp + 0xbc]
call fcn.140018ccc
test eax, eax
je 0x140062001
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.140013690
lea rdx, [rsp + 0xbc]
lea rcx, [rsp + 0x48]
call fcn.1400121b0
test byte [rsp + 0x90], 0x10
je 0x140061fd1
test sil, sil
je 0x140061f82
inc qword [rdi]
test bpl, bpl
je 0x140062001
lea rdx, [0x140096c8c]
lea rcx, [rsp + 0x48]
call fcn.1400121b0
mov r9, qword [rsp + 0x318]
mov r8, qword [rsp + 0x310]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x300]
mov byte [rsp + 0x30], bpl
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x20], rdi
call fcn.140061e50
mov bl, al
test al, al
je 0x140062020
jmp 0x140062001
mov eax, dword [rsp + 0xb0]
mov ecx, dword [rsp + 0xac]
shl rcx, 0x20
or rcx, rax
mov rax, qword [rsp + 0x310]
add qword [rax], rcx
test sil, sil
je 0x140062001
mov rax, qword [rsp + 0x318]
inc qword [rax]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140061ef1
jmp 0x140062020
xor bl, bl
mov rax, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x68]
call fcn.1400036e0
lea rcx, [rsp + 0x48]
call fcn.1400036e0
mov al, bl
mov rbx, qword [rsp + 0x308]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140062570
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
mov r14d, 1
mov r12, r8
mov r13, rdx
mov rsi, rcx
xor r15d, r15d
lea ebx, [r14 + 3]
mov bpl, r14b
mov r9, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, rbx
mov rdx, r14
call fcn.14001a6e8
lea rdx, [rsp + 0x20]
mov r9d, 0x18ee
mov r8d, ebx
mov rcx, rsi
call fcn.1400587b0
lea rdx, str.FILE
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x24], r15b
call fcn.140019b60
cmp eax, r15d
jne 0x14006271c
mov r9, qword [rsi]
lea rcx, [rsp + 0x498]
mov r8, r14
mov rdx, rbx
call fcn.14001a6e8
mov edi, dword [rsp + 0x498]
mov r9, qword [rsi]
xor edi, 0xadbc
lea rcx, [rsp + 0x30]
mov rdx, r14
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.14001a6e8
lea r9d, [rdi + 0xb33f]
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rsi
call fcn.1400587b0
movsxd r11, edi
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
mov word [rsp + r11*2 + 0x30], r15w
call fcn.140018120
mov r9, qword [rsi]
lea rcx, [rsp + 0x498]
mov r8, r14
mov edx, 4
call fcn.14001a6e8
mov edi, dword [rsp + 0x498]
mov r9, qword [rsi]
xor edi, 0xf820
lea rcx, [rsp + 0x30]
mov rdx, r14
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.14001a6e8
lea r9d, [rdi + 0xf479]
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rsi
call fcn.1400587b0
movsxd r11, edi
lea rdx, [rsp + 0x30]
mov rcx, r12
mov word [rsp + r11*2 + 0x30], r15w
call fcn.140018120
lea rcx, [rsp + 0x240]
mov rdx, r13
call fcn.140018ccc
cmp eax, r15d
je 0x14006274e
mov rcx, qword [rsi]
mov r8d, r14d
mov edx, r14d
call fcn.140019f7c
mov r9, qword [rsi]
mov ebx, 4
lea rcx, [rsp + 0x28]
mov rdx, rbx
mov r8, r14
call fcn.14001a6e8
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsi]
xor edx, 0x87bc
mov r8d, r14d
mov dword [rsp + 0x28], edx
add edx, 0x18
call fcn.140019f7c
jmp 0x14006271f
mov bpl, r15b
cmp bpl, r14b
je 0x1400625a8
mov eax, 6
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x14006272d
Function at 0x140062760
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6d0
mov edx, dword [rcx + 8]
xor r15d, r15d
mov r13, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov word [rsp + 0x68], r15w
mov r14, r8
lea r12d, [r15 + 1]
xor r8d, r8d
mov rbx, r9
mov word [rax - 0x486], r15w
mov qword [rax - 0x258], r15
mov dword [rsp + 0x24], r12d
call fcn.140019f7c
lea r8, [rsp + 0x4c0]
lea rdx, str.___AUTOIT_SCRIPT___
mov rcx, r13
call fcn.140062570
cmp eax, r15d
je 0x140062809
lea eax, [r15 + 6]
jmp 0x14006297b
mov r9, qword [r13]
lea rcx, [rsp + 0x700]
mov r8, r12
mov rdx, r12
call fcn.14001a6e8
mov r9, qword [r13]
mov ebp, 4
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov r8, r12
call fcn.14001a6e8
mov esi, dword [rsp + 0x20]
mov r9, qword [r13]
lea rcx, [rsp + 0x20]
mov edi, 0x87bc
mov r8, r12
mov rdx, rbp
xor esi, edi
call fcn.14001a6e8
mov r11d, dword [rsp + 0x20]
mov r9, qword [r13]
xor r11d, edi
lea rcx, [rsp + 0x20]
mov r8, r12
mov rdx, rbp
mov dword [rbx], r11d
call fcn.14001a6e8
mov edi, dword [rsp + 0x20]
mov rcx, qword [r13]
lea edx, [rbp + 0xc]
mov r8d, r12d
xor edi, 0xa685
call fcn.140019f7c
mov ecx, dword [rbx]
call fcn.140019288
movsxd rbx, esi
mov rcx, rbx
mov rbp, rax
call fcn.140019288
mov r9, qword [r13]
mov r8d, 1
mov rcx, rax
mov rdx, rbx
mov r12, rax
call fcn.14001a6e8
mov r9d, dword [r13 + 0xc]
mov r8d, esi
mov rdx, r12
mov rcx, r13
add r9d, 0x2477
call fcn.1400587b0
lea rcx, [rsp + 0x24]
mov r8d, esi
mov rdx, r12
call fcn.14003fe30
cmp edi, dword [rsp + 0x24]
je 0x140062903
mov rcx, rbp
call fcn.140019568
mov rcx, r12
call fcn.140019568
mov eax, 0xa
jmp 0x14006297b
cmp byte [rsp + 0x700], 1
jne 0x14006296b
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov word [rsp + 0x68], r15w
mov word [rsp + 0x272], r15w
mov qword [rsp + 0x4a0], r15
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbp
call fcn.1400589c0
mov rcx, r12
call fcn.140019568
jmp 0x140062976
mov rcx, rbp
call fcn.140019568
mov rbp, r12
mov qword [r14], rbp
xor eax, eax
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140063400
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13b, byte [0x1400ad243]
mov rsi, rdx
mov rdi, rcx
call fcn.14001afa4
mov edx, 0x8000
mov ecx, eax
call fcn.14001ae4c
mov rcx, rsi
mov ebp, eax
call fcn.140040080
test al, al
je 0x14006346c
call fcn.14004fa40
mov rcx, rsi
movsxd rbx, eax
call fcn.140062f70
mov r9, rdi
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.14001a224
mov r12, rax
jmp 0x1400634b2
call fcn.140058e00
or edx, 0xffffffff
mov rcx, rax
call fcn.140017380
lea rdx, [0x140099034]
mov rcx, rdi
mov r8, rax
mov rbx, rax
call fcn.14001afdc
mov rcx, rbx
movsxd r12, eax
call fcn.1400185f4
test r13b, r13b
je 0x1400634b2
mov rcx, rsi
call fcn.140058e00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rdi
call fcn.14001b30c
mov rcx, rdi
call fcn.14001afa4
mov edx, 0x4000
mov ecx, eax
cmp ebp, 0xffffffff
je 0x1400634d0
mov edx, ebp
call fcn.14001ae4c
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, r12
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x140063500
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xac0
mov rbx, rdx
lea rdx, [rsp + 0x280]
mov dil, r8b
call fcn.1400158f0
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.1400158f0
lea rcx, [rsp + 0x280]
call fcn.140041e40
xor ebx, ebx
cmp al, bl
jne 0x140063547
xor al, al
jmp 0x1400636da
lea rcx, [rsp + 0x70]
call fcn.140041e40
cmp al, bl
je 0x140063629
cmp dil, bl
je 0x140063540
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea rcx, [rsp + 0x280]
cmp eax, ebx
jne 0x1400635af
lea rdx, [rsp + 0x70]
call fcn.140018ccc
cmp eax, ebx
je 0x1400635a8
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebx
setne al
jmp 0x1400636da
mov al, 1
jmp 0x1400636da
lea rax, [rsp + 0x490]
lea r9, [rsp + 0x6a0]
lea r8, [rsp + 0x8b0]
lea rdx, [rsp + 0xae8]
mov qword [rsp + 0x20], rax
call fcn.1400198dc
lea rdx, [0x140096c8c]
lea rcx, [rsp + 0x70]
call fcn.1400180f4
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x70]
call fcn.1400180f4
cmp word [rsp + 0x490], bx
je 0x140063629
lea rdx, [0x140098e4c]
lea rcx, [rsp + 0x70]
call fcn.1400180f4
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x70]
call fcn.1400180f4
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
call fcn.140059d70
lea rcx, [rsp + 0x280]
cmp al, bl
je 0x140063672
lea rdx, [rsp + 0x70]
mov r8b, 1
call fcn.140059ad0
cmp al, bl
je 0x140063540
lea rcx, [rsp + 0x280]
mov dl, 1
call fcn.140059a20
cmp al, bl
jmp 0x1400635a0
call fcn.140018b2c
lea rcx, [rsp + 0x70]
mov word [rsp + rax*2 + 0x282], bx
call fcn.140018b2c
lea rcx, [rsp + 0x30]
mov word [rsp + rax*2 + 0x72], bx
lea rax, [rsp + 0x280]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x48], rax
mov eax, 0x614
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], 1
mov word [rsp + 0x50], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, ebx
sete al
mov rbx, qword [rsp + 0xad0]
add rsp, 0xac0
pop rdi
ret
Function at 0x1400636f0
Capabilities:
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
mov eax, 0x1300
call fcn.140030df0
sub rsp, rax
mov rbx, rdx
lea rdx, [rsp + 0x450]
xor edi, edi
mov r12b, r9b
mov r13b, r8b
mov sil, dil
call fcn.1400158f0
lea rdx, [rsp + 0x660]
mov rcx, rbx
call fcn.1400158f0
lea rdx, [rsp + 0x660]
lea rcx, [rsp + 0x450]
call fcn.140059d70
lea rcx, [rsp + 0x450]
mov r14b, al
call fcn.140041e40
cmp al, dil
je 0x14006377f
lea rdx, [0x140098e40]
lea rcx, [rsp + 0x450]
call fcn.1400180f4
lea rcx, [rsp + 0x660]
call fcn.140041e40
cmp al, dil
je 0x1400637a5
lea rdx, [0x140098e40]
lea rcx, [rsp + 0x660]
call fcn.1400180f4
lea rax, [rsp + 0xac0]
lea r9, [rsp + 0x10f0]
lea r8, [rsp + 0xcd0]
lea rdx, [rsp + 0xee0]
lea rcx, [rsp + 0x450]
mov qword [rsp + 0x20], rax
call fcn.1400198dc
lea rdx, [rsp + 0x870]
lea rcx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov bpl, 1
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14006394e
cmp bpl, 1
jne 0x14006394e
test byte [rsp + 0x870], 0x10
jne 0x140063920
lea rax, [rsp + 0x240]
lea r9, [rsp + 0x660]
lea r8, [rsp + 0xac0]
lea rdx, [rsp + 0x10f0]
lea rcx, [rsp + 0x89c]
mov qword [rsp + 0x20], rax
call fcn.140041c70
lea rdx, [rsp + 0xee0]
lea rcx, [rsp + 0x30]
call fcn.140018120
lea rdx, [rsp + 0xcd0]
lea rcx, [rsp + 0x30]
call fcn.1400180f4
lea rdx, [rsp + 0x89c]
lea rcx, [rsp + 0x30]
call fcn.1400180f4
lea rcx, [rsp + 0x240]
call fcn.140041eb0
cmp al, dil
je 0x1400638bd
cmp r13b, dil
je 0x140063941
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
je 0x1400638dd
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
cmp r12b, 1
jne 0x140063910
cmp r14b, dil
jne 0x1400638f6
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x140063919
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, edi
je 0x140063951
jmp 0x14006391d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, edi
je 0x140063941
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140063919
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, edi
je 0x140063941
mov sil, 1
lea rdx, [rsp + 0x870]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, edi
jne 0x1400637fd
mov bpl, dil
jmp 0x1400637fd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x14006395d
mov dil, sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, dil
lea r11, [rsp + 0x1300]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret