joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013220
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
sub rsp, 0x30
mov rsi, r8
test r8, r8
je 0x1400132b4
mov r8, qword [0x14007df78]
lea rax, [rsp + 0x48]
xor ebp, ebp
mov qword [rsp + 0x20], rax
lea r9, str.HardwareConfig
mov qword [rsp + 0x48], rbp
mov rdx, 0xffffffff80000002
call fcn.140010180
test eax, eax
je 0x1400132b4
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1400132b4
mov r8d, dword [rbx]
xor r8d, 0x92781293
cmp r8d, 0x20
jbe 0x1400132c6
lea edx, [rbp + 2]
mov qword [rsp + 0x40], rdi
lea rcx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x14001329f
mov word [rbx + 4], bp
mov edx, 4
mov word [rsi], bp
mov rcx, rbx
call fcn.140039910
mov rdi, qword [rsp + 0x40]
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov ecx, 7
mov r9d, ebp
test r8d, r8d
je 0x1400132f0
lea rax, [rbx + 4]
mov edx, r8d
mov r9d, r8d
nop dword [rax]
add ecx, 7
xor word [rax], cx
lea rax, [rax + 2]
sub rdx, 1
jne 0x1400132e0
mov eax, r9d
lea r8, [rbx + 4]
mov edx, 0x80
mov r9, 0xffffffffffffffff
mov rcx, rsi
mov word [rbx + rax*2 + 4], bp
call fcn.140045cc8
mov edx, 4
mov rcx, rbx
call fcn.140039910
mov rbx, qword [rsp + 0x50]
mov al, 1
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret

Function at 0x140013440
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
mov rbx, r8
mov rdi, rdx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r8d, r8d
mov edx, r8d
cmp word [rbx], dx
je 0x1400134bf
mov ecx, r8d
nop word [rax + rax]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400134a0
cmp rcx, rax
jae 0x1400134bf
add r8w, word [rbx + rcx*2]
inc edx
mov ecx, edx
cmp word [rbx + rdx*2], 0
jne 0x140013490
movabs rax, 0xffff000000000000
and qword [rdi], rax
movabs rax, 0x917aa921821c49ab
mov word [rdi + 6], r8w
xor qword [rdi], rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400398f0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140013c30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x860
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbx, qword [0x14007cd10]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesProcessGovernor
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013ded
lea rax, [rsp + 0x30]
mov qword [rsp + 0x870], rdi
xor edi, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], edi
lea rdx, str.SYSTEMCurrentControlSetServicesProcessGovernor
mov rcx, 0xffffffff80000002
lea r9d, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013d05
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x44], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DeleteFlag
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140013d33
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rdi, qword [rsp + 0x870]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400398f0
add rsp, 0x860
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x40], edi
je 0x140013d05
cmp byte [0x14007cb0f], dil
jne 0x140013ddb
mov r9d, 0x3ff
mov byte [0x14007cb0f], 1
lea r8, [rsp + 0x50]
mov word [rsp + 0x50], di
mov edx, 0x301
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140013dc1
cmp byte [0x140077c48], dil
je 0x140013d92
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x140077c48], dil
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x3ff
lea r8, [rsp + 0x50]
mov rcx, rax
mov edx, 0x301
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140013dc1
mov word [rsp + 0x50], di
mov r9d, 0x30
lea r8, [0x140068168]
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x140013d12
xor al, al
jmp 0x140013d1a
Function at 0x1400172d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140017363
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.UseFileSystemLocks
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140017377
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400398f0
add rsp, 0x58
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x38], 1
jne 0x140017363
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400398f0
add rsp, 0x58
ret
Function at 0x140025100
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x3120], 0
mov rbx, rcx
je 0x1400251d5
mov rcx, qword [rcx + 0x3248]
cmp dword [rcx - 0x10], 0
je 0x1400251d5
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x80000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400251d5
lea r9, [rsp + 0x48]
mov rcx, rax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, rdi
test eax, eax
jne 0x140025194
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400251d5
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], esi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x3118]
mov rcx, qword [rsp + 0x48]
cmp rcx, rdx
mov qword [rbx + 0x3118], rcx
setne al
cmp esi, dword [0x140081a00]
je 0x1400251d7
mov dword [0x140081a00], esi
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400398f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140025cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x850
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x840], rax
xor ecx, ecx
mov rax, rdx
mov word [rsp + 0x40], cx
lea rdx, str.SoftwareProcessLasso
lea rcx, [rsp + 0x30]
mov rbx, r8
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140025d5c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x38], 0x800
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ConfigFolderEx
mov dword [rsp + 0x3c], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140025d7f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140002ba0
xor al, al
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400398f0
add rsp, 0x850
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140025d91
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002210
mov al, 1
jmp 0x140025d66
Function at 0x1400260c0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, r8
mov rdi, rdx
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 1
xor eax, eax
mov qword [rdx], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140026297
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x20], 1
xor ebp, ebp
mov word [rsp + 0x30], bp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x103
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rbx, [rbp - 1]
test eax, eax
je 0x1400261db
lea rcx, [rsp + 0x30]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], bp
jne 0x140026156
dec eax
movsxd rcx, eax
test eax, eax
jle 0x140026183
cmp word [rsp + rcx*2 + 0x30], 0x5c
je 0x14002617c
dec eax
dec rcx
test rcx, rcx
jg 0x140026168
jmp 0x140026183
cdqe
mov word [rsp + rax*2 + 0x30], bp
lea rax, [rsp + 0x30]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], bp
jne 0x140026190
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140002210
test rsi, rsi
jne 0x1400261b1
mov r8d, ebp
jmp 0x1400261be
mov r8, rbx
inc r8
cmp word [rsi + r8*2], bp
jne 0x1400261b4
mov rdx, rsi
mov rcx, rdi
call fcn.140004940
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140026271
mov word [rsp + 0x30], bp
xor r9d, r9d
lea r8d, [r9 + 0x24]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x140026268
lea rax, [rsp + 0x30]
mov r8, rbx
inc r8
cmp word [rax + r8*2], bp
jne 0x140026200
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140002210
lea rdx, str.media
mov r8, rbx
inc r8
cmp word [rdx + r8*2], bp
jne 0x140026221
mov rcx, rdi
call fcn.140004940
test rsi, rsi
je 0x14002624c
nop dword [rax + rax]
inc rbx
cmp word [rsi + rbx*2], bp
jne 0x140026240
mov rbp, rbx
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call fcn.140004940
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140026271
mov rcx, rdi
call fcn.140002ba0
nop
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400398f0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002c40
int3
Function at 0x1400262b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x3260]
mov ebx, 0xffffffff
cmp dword [rcx - 0x10], 0
je 0x1400262d8
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140026318
lea r8, str.lower.wav
lea rdx, [rsp + 0x40]
call fcn.1400260c0
nop
mov rdx, rax
lea rcx, [rsi + 0x3260]
call fcn.140001e50
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140026318
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rcx, qword [rsi + 0x3260]
cmp dword [rcx - 0x10], 0
je 0x140026330
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140026370
lea r8, str.Windows_Pop_up_Blocked.wav
lea rdx, [rsp + 0x48]
call fcn.1400260c0
nop
mov rdx, rax
lea rcx, [rsi + 0x3260]
call fcn.140001e50
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140026370
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rcx, qword [rsi + 0x3268]
cmp dword [rcx - 0x10], 0
je 0x140026388
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400263c8
lea r8, str._raise.wav
lea rdx, [rsp + 0x50]
call fcn.1400260c0
nop
mov rdx, rax
lea rcx, [rsi + 0x3268]
call fcn.140001e50
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400263c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rcx, qword [rsi + 0x3268]
cmp dword [rcx - 0x10], 0
je 0x1400263e0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002641e
lea r8, str.Windows_Feed_Discovered.wav
lea rdx, [rsp + 0x58]
call fcn.1400260c0
nop
mov rdx, rax
lea rcx, [rsi + 0x3268]
call fcn.140001e50
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14002641e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov al, 1
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400281a0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x2070
call fcn.14003a390
sub rsp, rax
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov rsi, rdx
mov rcx, rdx
call fcn.140002ba0
xor r14d, r14d
mov qword [rsp + 0x48], r14
lea rdx, [rsp + 0x48]
call fcn.140014de0
nop
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r14 + 3]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov rbx, 0xffffffffffffffff
cmp rax, rbx
jne 0x140028233
mov rcx, rsi
call fcn.140002ba0
jmp 0x14002837b
mov dword [rsp + 0x40], r14d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp eax, 0x1000
jae 0x14002836a
cmp dword [rsp + 0x40], 0
jne 0x14002836a
test eax, eax
jne 0x14002827b
mov rcx, rsi
call fcn.140002ba0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dil, 1
jmp 0x14002837e
xor edx, edx
mov r8d, 0x2002
lea rcx, [rsp + 0x50]
call fcn.14005af20
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov r8d, ebp
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140028372
lea rax, [rsp + 0x50]
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400282c0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140002210
lea r8, [0x1400690cc]
lea rdx, [0x14006c0a0]
mov rcx, rsi
call fcn.14000f630
lea r8, [0x1400690cc]
lea rdx, [0x14006c0a4]
mov rcx, rsi
call fcn.14000f630
lea r8, [0x1400690cc]
lea rdx, [0x14006c0a8]
mov rcx, rsi
call fcn.14000f630
lea r8, [0x1400690cc]
lea rdx, [0x140069334]
mov rcx, rsi
call fcn.14000f630
lea r8, [0x1400690cc]
lea rdx, [0x140068280]
mov rcx, rsi
call fcn.14000f630
lea r8, [0x1400690cc]
lea rdx, [0x14006c0ac]
mov rcx, rsi
call fcn.14000f630
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dil, 1
jmp 0x14002837e
mov rcx, rsi
call fcn.140002ba0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor dil, dil
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14002839b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
movzx eax, dil
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.1400398f0
lea r11, [rsp + 0x2070]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140028800
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x30e0]
test rcx, rcx
je 0x1400288bb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30e0], 0
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x1400288d5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140025db0
lea rdx, str..pl_lock
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140028880
lea rcx, [rsp + 0x20]
call fcn.140004940
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400288bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400398f0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x80004005
call fcn.140002c40
int3

Function at 0x1400288e0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x1400289a2
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140025db0
lea rdx, str..pl_lock
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x140028940
lea rcx, [rsp + 0x20]
call fcn.140004940
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
sete sil
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140028981
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
movzx eax, sil
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400398f0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x80004005
call fcn.140002c40
int3
Function at 0x140032220
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r15, r8
mov rdi, rdx
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x1400323d5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, str.Process_Lasso_12.4.4.22
lea rcx, [rsp + 0x38]
cmp rdx, 0x10000
jae 0x140032288
movzx edx, dx
call fcn.140001fa0
jmp 0x140032294
mov r8d, 0x17
call fcn.140002210
nop
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r13, rax
lea r14d, [rbp - 1]
test rax, rax
je 0x140032391
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0x84000000
mov r9d, 0xffffffff
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov r12, rax
test rax, rax
je 0x140032391
mov ecx, 0x1000
call fcn.140039d3c
mov qword [r15], rax
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
call fcn.14005af20
mov dword [rsp + 0x30], ebp
mov edi, ebp
mov rdx, qword [r15]
add rdx, rdi
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [rsp + 0x30]
test eax, eax
je 0x140032337
test ecx, ecx
je 0x14003237d
add ebp, ecx
lea eax, [rbp + 0x1000]
movsxd rdi, eax
mov rcx, rdi
call fcn.140039d3c
mov rsi, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.14005af20
movsxd rdi, ebp
mov r8, rdi
mov rdx, qword [r15]
mov rcx, rsi
call fcn.14005a880
mov edx, 1
mov rcx, qword [r15]
call fcn.140039910
mov qword [r15], rsi
jmp 0x140032311
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x140032394
mov ebp, r14d
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x1400323ae
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
mov eax, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400398f0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002c40
int3
Function at 0x1400341e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x360
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rsp + 0x340], rax
cmp qword [0x14007d558], 0
mov rdi, rcx
je 0x140034478
cmp qword [0x14007d548], 0
je 0x140034478
cmp byte [0x140081a27], 0
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], r14
jne 0x140034435
xor edx, edx
mov byte [0x140081a27], 1
mov r8d, 0x1fe
lea rcx, [r11 - 0x226]
xor bl, bl
call fcn.14005af20
mov rdx, qword [rdi + 8]
lea rax, [rsp + 0x30]
mov rsi, qword [rdi]
mov r14d, 1
xor ebp, ebp
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov word [rsp + 0x140], bp
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003442d
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x140]
mov dword [rsp + 0x38], 0x200
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov dword [rsp + 0x3c], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x1400342e6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x140081a26], bl
jmp 0x14003443c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rsp + 0x140], bp
je 0x14003442d
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140081a30], eax
jle 0x14003436c
lea rcx, [0x140081a30]
call fcn.140039dec
cmp dword [0x140081a30], 0xffffffff
jne 0x14003436c
mov qword [0x140081a28], rbp
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x14003447c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea rcx, [0x14005e170]
mov qword [0x140081a28], rax
call fcn.140039ba8
lea rcx, [0x140081a30]
call fcn.140039d80
mov rax, qword [0x140081a28]
cmp dword [rax - 0x10], ebp
jne 0x140034400
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call fcn.14005af20
mov r8d, 0x80
lea rdx, [rsp + 0x40]
lea rcx, [0x140067cc0]
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bp
jne 0x1400343b2
lea rdx, [rsp + 0x40]
lea rcx, [0x140081a28]
call fcn.140002210
xor r8d, r8d
lea rdx, [0x14006dd90]
lea rcx, [0x140081a28]
call fcn.14000f630
xor r8d, r8d
lea rdx, [0x14006dd94]
lea rcx, [0x140081a28]
call fcn.14000f630
mov rax, qword [0x140081a28]
lea r8, [rsp + 0x140]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140034424
add rax, 2
test ecx, ecx
jne 0x140034410
test edx, edx
movzx ebx, bl
cmovne ebx, r14d
mov byte [0x140081a26], bl
jmp 0x14003443c
movzx ebx, byte [0x140081a26]
mov rsi, qword [rsp + 0x358]
movzx eax, bl
mov rbx, qword [rsp + 0x378]
mov rbp, qword [rsp + 0x380]
mov r14, qword [rsp + 0x350]
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.1400398f0
add rsp, 0x360
pop rdi
ret
xor al, al
jmp 0x14003445f
mov ecx, 0x80004005
call fcn.140002c40
int3