joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403265a0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x40], 1
lea rcx, [rsp + 0x48]
lea rdx, [0x1403da4b0]
call fcn.140006f04
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x28], r9d
mov r8, qword [rax]
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14032660a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x30
pop rbx
ret
Function at 0x140327090
Capabilities:
Get common file path
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
sub rsp, 0x698
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rdi, rcx
xor esi, esi
mov dword [rbp], esi
lea rdx, [0x1403da228]
lea rcx, [rbp + 0x698]
call fcn.140004900
nop
mov ebx, 0x20a
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x440]
call fcn.14028ace0
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x230]
call fcn.14028ace0
mov dword [rbp + 0x680], esi
mov dword [rbp + 0x690], esi
mov dword [rbp + 0x688], esi
xor edx, edx
lea r8d, [rbx - 2]
lea rcx, [rbp + 0x20]
call fcn.14028ace0
xor r9d, r9d
lea r8d, [rsi + 0x25]
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov word [rbp + 0x26], si
mov r8d, 0x105
mov dword [rsp + 0x38], r8d
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x688]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x690]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x680]
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1403271b9
lea rdx, [0x1403da778]
lea rcx, [rbp + 8]
call fcn.140006dc8
nop
mov r8d, dword [rbp + 0x680]
mov rdx, qword [rax]
lea rcx, [rbp + 0x698]
call fcn.140009970
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1403271b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rbp + 0x698]
test r8, r8
je 0x140327233
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [r8 + rcx], sil
jne 0x1403271c9
inc ecx
cmp ecx, 0x3fffffff
jg 0x140327233
movsxd rax, ecx
add rax, rax
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x1403271f5
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.140282bd0
sub rsp, rdx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x140327233
mov word [rbx], si
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
or r9d, 0xffffffff
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rdx, rdx
and rdx, rbx
jmp 0x140327236
mov rdx, rsi
mov rcx, rdi
call fcn.140007b48
nop
mov rdx, qword [rbp + 0x698]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140327260
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
lea rsp, [rbp + 0x658]
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140327278
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xc58
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rsi, rcx
xor r14d, r14d
mov dword [rbp], r14d
lea rdx, [0x1403da464]
call fcn.140007b48
mov dword [rbp], 1
mov ebx, 0x800
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x420]
call fcn.14028ace0
mov dword [rbp + 0xc68], ebx
lea rdx, [0x1403da6f0]
lea rcx, [rbp + 0xc78]
call fcn.140006f04
lea rcx, [rbp + 0xc70]
mov qword [rsp + 0x20], rcx
mov r9d, 0x101
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete bl
mov rdx, qword [rbp + 0xc78]
add rdx, 0xffffffffffffffe8
or r15, 0xffffffffffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140327336
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x140327494
lea rdx, [0x1403da750]
lea rcx, [rbp + 8]
call fcn.140006f04
lea rcx, [rbp + 0xc68]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x420]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbp + 0xc70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x14032739f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
test ebx, ebx
jne 0x140327487
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x20]
call fcn.14028ace0
mov r8d, dword [rbp + 0xc68]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x420]
call fcn.1403274b0
lea rax, [rbp + 0x20]
mov rcx, r15
inc rcx
cmp byte [rax + rcx], r14b
jne 0x1403273d6
inc ecx
cmp ecx, 0x3fffffff
jg 0x140327444
movsxd rax, ecx
add rax, rax
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x140327402
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.140282bd0
sub rsp, rdx
lea rdi, [rsp + 0x30]
test rdi, rdi
je 0x140327444
mov word [rdi], r14w
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdi
mov r9d, r15d
lea r8, [rbp + 0x20]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rbx, rbx
and rbx, rdi
jmp 0x140327447
mov rbx, r14
lea rdx, [0x1403da47c]
lea rcx, [rbp + 0x10]
call fcn.140006f04
nop
mov r8, rbx
mov rdx, qword [rax]
mov rcx, rsi
call fcn.140009708
nop
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140327487
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0xc70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
lea rsp, [rbp + 0xc28]
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140327bb8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov rdi, r8
mov r10, rdx
mov r14, rcx
xor r15d, r15d
mov dword [rbp - 0x4c], r15d
lea r13d, [r15 + 0xf]
mov qword [rcx + 0x18], r13
mov qword [rcx + 0x10], r15
cmp qword [rcx + 0x18], 0x10
jb 0x140327c13
mov rax, qword [rcx]
jmp 0x140327c16
mov rax, r14
mov byte [rax], r15b
mov r12d, 1
mov dword [rbp - 0x4c], r12d
cmp qword [r8 + 0x18], 0x10
jb 0x140327c2f
mov rdx, qword [r8]
jmp 0x140327c32
mov rdx, rdi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140327d4e
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x50], r15d
cmp qword [rbx + 0x18], 0x10
jb 0x140327c71
mov rdx, qword [rbx]
jmp 0x140327c74
mov rdx, rbx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140327d33
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x140327d33
mov edx, eax
lea rcx, [rbp - 0x38]
call fcn.140004554
cmp qword [rbx + 0x18], 0x10
jb 0x140327cbc
mov rdx, qword [rbx]
jmp 0x140327cbf
mov rdx, rbx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov rsi, qword [rbp - 0x38]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140327d37
mov r8, qword [rbp - 0x30]
dec r8
mov qword [rbp - 8], r13
mov qword [rbp - 0x10], r15
mov byte [rbp - 0x20], r15b
cmp rsi, r8
je 0x140327d0c
sub r8, rsi
mov rdx, rsi
lea rcx, [rbp - 0x20]
call fcn.140003844
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.14000488c
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140327d37
inc rdx
mov r8, r12
mov rcx, qword [rbp - 0x20]
call fcn.1400042c4
jmp 0x140327d37
mov rsi, qword [rbp - 0x38]
test rsi, rsi
je 0x140327d4e
mov rdx, qword [rbp - 0x28]
sub rdx, rsi
mov r8, r12
mov rcx, rsi
call fcn.1400042c4
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rdi + 0x18], 0x10
jb 0x140327d72
mov rdx, qword [rdi + 0x18]
add rdx, r12
mov r8, r12
mov rcx, qword [rdi]
call fcn.1400042c4
mov qword [rdi + 0x18], r13
mov qword [rdi + 0x10], r15
cmp qword [rdi + 0x18], 0x10
jb 0x140327d84
mov rdi, qword [rdi]
mov byte [rdi], r15b
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140327d9f
inc rdx
mov r8, r12
mov rcx, qword [rbx]
call fcn.1400042c4
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x10], r15
cmp qword [rbx + 0x18], 0x10
jb 0x140327db1
mov rbx, qword [rbx]
mov byte [rbx], r15b
mov rax, r14
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140327ddc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
and dword [rsp + 0x58], 0
mov rbx, r8
cmp qword [rdx + 0x18], 0x10
mov rdi, rdx
jb 0x140327df9
mov rdx, qword [rdx]
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140327e52
cmp qword [rbx + 0x18], 0x10
mov dword [rsp + 0x60], 4
jb 0x140327e2a
mov rdx, qword [rbx]
jmp 0x140327e2d
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi + 0x18]
mov esi, dword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140327e7c
mov rcx, qword [rdi]
inc rdx
mov r8d, 1
call fcn.1400042c4
mov qword [rdi + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rdi + 0x10], 0
cmp qword [rdi + 0x18], 0x10
jb 0x140327e93
mov rdi, qword [rdi]
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140327eb1
mov rcx, qword [rbx]
inc rdx
mov r8d, 1
call fcn.1400042c4
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rbx + 0x10], 0
cmp qword [rbx + 0x18], 0x10
jb 0x140327ec8
mov rbx, qword [rbx]
mov byte [rbx], 0
mov eax, esi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1403284ac
Capabilities:
Check http status code

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x98
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov rbx, rcx
xor r12d, r12d
mov sil, r12b
lea rdx, [0x1403da9b0]
lea rcx, [rbp - 0x29]
call fcn.140006dc8
nop
mov qword [rbp - 1], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp - 9], r12
mov byte [rbp - 0x19], r12b
mov rdx, qword [rbp - 0x29]
cmp byte [rdx], r12b
jne 0x140328501
mov r8d, r12d
jmp 0x14032850e
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x140328505
lea rcx, [rbp - 0x19]
call fcn.140003844
mov r15d, 1
mov r9d, r15d
mov r8d, 0x1bb
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.140329698
cmp byte [rbx + 0x20], r12b
je 0x140328641
xor edx, edx
lea rcx, [rbp + 7]
call fcn.140329338
nop
cmp qword [rax + 0x18], 0x10
jb 0x140328552
mov rax, qword [rax]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], 0x4883000
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, str.HTTP_1.0
lea r8, [0x1403da9a0]
mov rdx, rax
mov rcx, qword [rbx + 0x30]
call qword [rbx + 0x50]
mov rdi, rax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14032859d
inc rdx
mov r8, r15
mov rcx, qword [rbp + 7]
call fcn.1400042c4
mov qword [rbp + 0x1f], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x17], r12
mov byte [rbp + 7], r12b
test rdi, rdi
je 0x140328638
mov r15d, 4
mov dword [rbp + 0x77], r15d
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x67]
lea edx, [r15 + 0x1b]
mov rcx, rdi
call qword [rbx + 0x58]
or dword [rbp + 0x67], 0x180
mov r9d, r15d
lea r8, [rbp + 0x67]
lea edx, [r15 + 0x1b]
mov rcx, rdi
call qword [rbx + 0x60]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [rbx + reloc.OLEAUT32.dll_VarCyFromDisp]
mov dword [rbp + 0x6f], r12d
mov dword [rbp + 0x7f], r15d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x7f]
lea r8, [rbp + 0x6f]
mov edx, 0x20000013
mov rcx, rdi
call qword [rbx + 0x88]
movzx esi, sil
cmp dword [rbp + 0x6f], 0xc8
lea eax, [r15 - 3]
cmove esi, eax
mov rcx, rdi
call qword [rbx + 0x78]
mov rcx, rbx
call fcn.140329664
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140328660
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, sil
add rsp, 0x98
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140329820
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rcx + 0x10], 0
cmp qword [rcx + 0x18], 0x10
jb 0x140329854
mov rax, qword [rcx]
jmp 0x140329857
mov rax, rbx
mov byte [rax], 0
mov byte [rcx + 0x20], 0
and qword [rcx + 0x28], 0
and qword [rcx + 0x30], 0
lea rdx, [0x1403da7b0]
lea rcx, [rsp + 0x68]
call fcn.140006dc8
nop
mov qword [rsp + 0x40], reloc.OLEAUT32.dll_SafeArrayDestroy
and qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
mov rdx, qword [rsp + 0x68]
cmp byte [rdx], 0
jne 0x14032989d
xor r8d, r8d
jmp 0x1403298ab
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1403298a1
lea rcx, [rsp + 0x28]
call fcn.140003844
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.14000488c
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1403298e0
inc rdx
mov r8d, 1
mov rcx, qword [rsp + 0x28]
call fcn.1400042c4
lea rcx, str.WinInet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1403299d1
lea rdx, str.InternetOpenA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
lea rdx, str.InternetConnectA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
lea rdx, str.HttpOpenRequestA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
lea rdx, str.InternetQueryOptionA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
lea rdx, str.InternetSetOptionA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x60], rax
lea rdx, str.HttpSendRequestA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x68], rax
lea rdx, str.InternetReadFile
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x70], rax
lea rdx, str.InternetCloseHandle
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x78], rax
lea rdx, str.InternetOpenUrlA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x80], rax
lea rdx, str.HttpQueryInfoA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x88], rax
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1403299f1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x14032a510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.14032a5b8
mov rdi, rax
test rax, rax
je 0x14032a592
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x616d6d6f
mov rcx, rax
mov word [rbp - 0x1b], 0x646e
mov word [rbp - 0x14], 0x416f
mov dword [rbp - 0x18], 0x54656e69
mov dword [rbp - 0x11], 0x577667
mov byte [rbp - 0x20], 0x43
mov byte [rbp - 0x19], 0x4c
mov byte [rbp - 0x12], reloc.OLEAUT32.dll_VarBstrFromDisp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14032a58a
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, rax
mov rcx, rdi
call fcn.14032a664
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x14032a60c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x6c
mov dword [rbp - 0x1a], 0x65006e
xor eax, eax
mov word [rbp - 0x16], cx
mov word [rbp - 8], ax
mov dword [rbp - 0x1e], 0x720065
lea eax, [rcx - 0x21]
mov dword [rbp - 0xc], 0x6c006c
lea rcx, [rbp - 0x20]
mov word [rbp - 0x20], ax
mov dword [rbp - 0x14], 0x320033
mov dword [rbp - 0x10], 0x64002e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add rsp, 0x40
pop rbp
ret
Function at 0x14032acf0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
lea rbx, [0x140482300]
mov qword [rsp + 0x50], rbx
xor edx, edx
mov rcx, rbx
call fcn.140011c28
nop
lea rax, vtable.GDUninstallerApp.0
mov qword [0x140482300], rax
lea rcx, [0x140482478]
call fcn.14032a3d0
nop
lea rdx, [0x1403dac30]
lea rcx, [rsp + 0x40]
call fcn.140006f04
mov r8, qword [rax]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [0x140482280], rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14032ad7c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x140482280]
test rcx, rcx
je 0x14032ad97
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, [0x1403dac30]
lea rcx, [rsp + 0x48]
call fcn.140006f04
mov r8, qword [rax]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140482280], rax
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14032addd
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14032b99c
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
and qword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, SafeArrayAllocData
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14032ba1e
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14032ba1e
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
and qword [rsp + 0x28], 0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
and qword [rsp + 0x20], 0
xor edx, edx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x48
ret
Function at 0x14001115e
Capabilities:
Write file on windows

Disassembly:
jmp 0x140026bc0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140047068]
call fcn.140011d4d
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140026c18
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140026d2a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x140026cc3
cmp qword [rbp + 0x28], 0
jle 0x140026cc3
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x140026c61
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011c58
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x140026d19
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140026d19
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140011776
Capabilities:
Terminate process

Disassembly:
jmp 0x140029e20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400117ee
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
jmp 0x140025e40
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14004710a]
call fcn.140011d4d
nop
mov rcx, qword [rbp + 0x100]
call fcn.140011140
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xffffffff
jne 0x140025eb5
lea rdx, str.Failed_to_get_attributes_for:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011186
mov rdx, qword [rbp + 0x100]
mov rcx, rax
call fcn.140011bcc
lea rdx, [0x14001108c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
xor al, al
jmp 0x140025f13
mov eax, dword [rbp + 4]
or eax, 6
mov dword [rbp + 4], eax
mov rcx, qword [rbp + 0x100]
call fcn.140011140
mov edx, dword [rbp + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x140025f11
lea rdx, str.Failed_to_set_attributes_for:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011186
mov rdx, qword [rbp + 0x100]
mov rcx, rax
call fcn.140011bcc
lea rdx, [0x14001108c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
xor al, al
jmp 0x140025f13
mov al, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret