joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b1430
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x1000b1488
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000b1460
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000b1478
mov ebx, 0x80004005
jmp 0x1000b1491
test al, 1
je 0x1000b14c2
and eax, 0xfffffffe
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1000b14c2
jmp 0x1000b144f
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1000b148d
mov ebx, 0x80070057
test ebx, ebx
jns 0x1000b14c2
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x1000b14c2
test byte [rcx + 0x3c], 2
je 0x1000b14c2
mov rcx, qword [rcx + 0x30]
lea r8, [0x100021040]
mov edx, 0x34
mov r9d, ebx
call fcn.100050618
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1000b4984
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp dword [0x100349dc8], 1
je 0x1000b499b
mov ebx, 0x8000ffff
jmp 0x1000b49d7
mov r8, rcx
mov rcx, qword [0x100347f18]
mov edx, 0x40
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1000b4a08
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000b49c5
mov ebx, 0x80004005
jmp 0x1000b49d7
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x1000b4a08
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x1000b4a08
test byte [rcx + 0x3c], 2
je 0x1000b4a08
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020dc0]
mov edx, 0xa
mov r9d, ebx
call fcn.100050618
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1000b6714
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x10], 0
mov dword [rax - 0x18], r9d
mov rsi, r8
lea r9, [rax - 0x10]
mov r8d, 2
call fcn.10004fa18
lea rbp, [0x100331948]
mov edi, eax
test eax, eax
js 0x1000b678c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1000b677a
xor edi, edi
jmp 0x1000b67b6
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x1000b67b6
mov rcx, qword [0x100331948]
cmp rcx, rbp
je 0x1000b67bd
test byte [rcx + 0x3c], 2
je 0x1000b67bd
mov rcx, qword [rcx + 0x30]
lea r8, [0x100021080]
mov edx, 0x24
mov r9d, edi
call fcn.100050618
mov rcx, qword [0x100331948]
cmp qword [rsp + 0x38], 0
je 0x1000b67d7
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x100331948]
test edi, edi
jns 0x1000b67fe
cmp rcx, rbp
je 0x1000b67fe
test byte [rcx + 0x3c], 2
je 0x1000b67fe
mov rcx, qword [rcx + 0x30]
lea r8, [0x100021080]
mov edx, 0x23
mov r9d, edi
call fcn.100050618
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x40
pop rdi
ret

Function at 0x1000b70bc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
xor eax, eax
mov rsi, rdx
mov dword [rsp + 0x20], ebp
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov rdi, rcx
mov qword [r11 + 8], rbp
cmp rcx, rbp
jne 0x1000b70f9
mov ebx, 0x80070057
jmp 0x1000b7189
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, 1
cmp eax, 0xffffffff
je 0x1000b7113
movzx eax, al
shr eax, 4
and eax, edx
jmp 0x1000b7115
mov eax, ebp
mov ebx, ebp
cmp eax, ebp
jne 0x1000b71ba
cmp rsi, rbp
je 0x1000b716f
lea r8, [rsp + 0x50]
xor r9d, r9d
mov rcx, rsi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
cmp eax, ebp
jne 0x1000b7159
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebp
jne 0x1000b7149
mov ebx, 0x80004005
jmp 0x1000b7189
movzx ebx, ax
or ebx, 0x80070000
cmp eax, ebp
cmovle ebx, eax
jmp 0x1000b7185
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0x18
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rax
cmp rsi, rbp
lea rdx, [rsp + 0x20]
mov rcx, rdi
cmove rdx, rbp
call fcn.1000b7884
mov ebx, eax
cmp ebx, ebp
jge 0x1000b71ba
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x1000b71ba
test byte [rcx + 0x3c], 2
je 0x1000b71ba
mov rcx, qword [rcx + 0x30]
lea r8, [0x100021040]
mov edx, 0x1e
mov r9d, ebx
call fcn.100050618
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x1000b71ca
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1000bb26c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
call fcn.1000f8a58
nop
jns 0x1000bb293
add byte [rax], dh
mov word [rdx - 0x49421fce], ds
and dword [rax - 0x70], esi
invalid
Function at 0x1000f9b5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
and dword [rax - 0x28], 0
and dword [rax - 0x24], 0
and qword [rax - 0x20], 0
and qword [rax - 0x38], 0
and qword [rax - 0x30], 0
mov r13, rcx
xor ecx, ecx
mov rbp, r8
mov r12, rdx
mov qword [rax + 0x20], rcx
xor esi, esi
lea rbx, [0x10003f510]
test rcx, rcx
je 0x1000f9bb6
call fcn.100218090
and qword [rsp + 0x88], 0
mov r8d, dword [rbx - 8]
mov rcx, qword [r13 + 0x20]
lea r9, [rsp + 0x88]
mov rdx, r12
call fcn.100218704
mov edi, eax
test eax, eax
js 0x1000f9c90
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call fcn.10005058c
mov edi, eax
test eax, eax
js 0x1000f9c90
mov rcx, qword [rsp + 0x88]
lea rdx, [rsp + 0x38]
call fcn.10005058c
mov edi, eax
test eax, eax
js 0x1000f9c90
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1000fba18
mov edi, eax
test eax, eax
js 0x1000f9c90
inc esi
add rbx, 0x10
cmp esi, 2
jae 0x1000f9c38
mov rcx, qword [rsp + 0x88]
jmp 0x1000f9ba3
and dword [rsp + 0x20], 0
and dword [rsp + 0x24], 0
and qword [rsp + 0x28], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1000fcc30
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.1000fcc30
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1000fca5c
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x1000f9cc1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1000f9cc1
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x1000f9cc1
test byte [rcx + 0x3c], 2
je 0x1000f9cc1
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020648]
mov edx, 0x12
mov r9d, edi
call fcn.100050618
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1000f9cdc
call fcn.100218090
and qword [rsp + 0x88], 0
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x1000f9cfb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1000f9d1a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.1000fca5c
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1000f9d44
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1001037cc
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r13, rdx
mov r15, rcx
xor edi, edi
and qword [rax - 0x38], rdi
and qword [rax - 0x30], rdi
lea rdx, [rax - 0x30]
mov rcx, r13
mov r12, r9
mov r14, r8
or rbx, 0xffffffffffffffff
call fcn.1000767b4
mov rsi, qword [rsp + 0x58]
mov ebp, eax
test eax, eax
js 0x100103955
and qword [rsp + 0x30], rdi
and dword [rsp + 0x28], edi
lea r8d, [rbx + 2]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rsi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x10010392e
cmp rax, 0xffffffffffffffff
je 0x10010392e
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp eax, 0xffffffff
je 0x100103932
cmp dword [rsp + 0x40], edi
je 0x100103882
mov ebp, 0x80070057
jmp 0x100103955
cmp ebp, 0x100000
ja 0x100103878
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x1001038b0
mov ebp, 0x8007000e
jmp 0x100103955
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, ebp
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100103932
cmp dword [rsp + 0x44], ebp
je 0x1001038db
mov ebp, 0x8000ffff
jmp 0x100103955
mov rcx, qword [r15 + 0xb8]
lea rdx, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
mov r8d, ebp
mov rdx, rdi
call qword [rax + 0x18]
mov ebp, eax
test eax, eax
js 0x100103955
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, r14
call fcn.100104f8c
mov ebp, eax
test eax, eax
js 0x100103955
lea rdx, [r12 + 0x38]
mov rcx, r13
call fcn.10005058c
mov ebp, eax
jmp 0x100103951
or rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100103943
mov ebp, 0x80004005
jmp 0x100103955
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
test ebp, ebp
jns 0x100103986
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x100103986
test byte [rcx + 0x3c], 2
je 0x100103986
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020578]
mov edx, 0x21
mov r9d, ebp
call fcn.100050618
test rsi, rsi
je 0x1001039a0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1001039b6
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsp + 0x50], 0
test rdi, rdi
je 0x1001039cf
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x1001039e3
cmp rbx, 0xffffffffffffffff
je 0x1001039e3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x60]
mov eax, ebp
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100110c2c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
test edx, edx
je 0x100110d0b
cmp dword [rcx + 0x20], 0
jne 0x100110d0b
mov rcx, qword [0x100331948]
lea rbx, [0x100331948]
cmp rcx, rbx
je 0x100110c85
mov eax, dword [rcx + 0x3c]
mov edx, 0x8000004
and eax, edx
cmp eax, edx
jne 0x100110c85
mov r9, qword [rdi + 0x10]
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020478]
mov edx, 0xf
call fcn.1000fec0c
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x100110c9f
cmp rcx, 0xffffffffffffffff
je 0x100110c9f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rdi + 8], 0xffffffffffffffff
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100110cb7
mov rdx, qword [rdi + 0x10]
jmp 0x100110df6
mov rax, qword [0x100331948]
cmp rax, rbx
je 0x100110dfe
mov eax, dword [rax + 0x3c]
mov ecx, 0x1000004
and eax, ecx
cmp eax, ecx
jne 0x100110dfe
mov rbx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100331948]
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020478]
mov edx, 0x10
mov r9, rbx
mov dword [rsp + 0x20], eax
call fcn.1000cae90
jmp 0x100110dfe
mov rax, qword [rcx + 8]
test rax, rax
je 0x100110dfe
cmp rax, 0xffffffffffffffff
je 0x100110dfe
test rax, rax
je 0x100110dfe
cmp dword [rcx], 0
lea rbx, [0x100331948]
jne 0x100110d8c
cmp dword [rcx + 0x20], 0
jne 0x100110d8c
mov rcx, qword [0x100331948]
cmp rcx, rbx
je 0x100110d6c
mov eax, dword [rcx + 0x3c]
mov edx, 0x8000004
and eax, edx
cmp eax, edx
jne 0x100110d6c
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020478]
mov edx, 0x11
call fcn.10010e928
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x100110d7b
cmp rcx, 0xffffffffffffffff
jne 0x100110d7d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
test eax, eax
sete cl
mov dword [rdi], ecx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x100110da6
cmp rcx, 0xffffffffffffffff
je 0x100110da6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rdi + 8], 0xffffffffffffffff
cmp dword [rdi + 0x20], 0
jne 0x100110dfe
cmp dword [rdi], 0
je 0x100110df2
mov r10, qword [0x100331948]
cmp r10, rbx
je 0x100110cae
mov eax, dword [r10 + 0x3c]
mov ecx, 0x1000004
and eax, ecx
cmp eax, ecx
jne 0x100110cae
mov r9, qword [rdi + 0x10]
mov rcx, qword [r10 + 0x30]
lea r8, [0x100020478]
mov edx, 0x12
call fcn.1000fec0c
jmp 0x100110cae
mov rdx, qword [rdi + 0x18]
mov rcx, rdi
call fcn.10011182c
mov dword [rdi + 0x20], 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x100111580
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 8]
xor ebx, ebx
mov rdi, rdx
test rax, rax
je 0x1001115dd
cmp rax, 0xffffffffffffffff
je 0x1001115dd
test rax, rax
je 0x1001115dd
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x1001115ae
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x1001115d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001115dd
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1001115d7
mov dword [rdi], eax
test ebx, ebx
jns 0x100111613
jmp 0x1001115e2
mov ebx, 0x80004005
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x100111613
test byte [rcx + 0x3c], 2
je 0x100111613
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020478]
mov edx, 0x13
mov r9d, ebx
call fcn.100050618
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100111744
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x50
and qword [r11 - 0x28], 0
xor eax, eax
xor ebx, ebx
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
mov rax, qword [rcx + 8]
mov edi, r8d
test rax, rax
je 0x1001117e8
cmp rax, 0xffffffffffffffff
je 0x1001117e8
test rax, rax
je 0x1001117e8
mov rcx, qword [rcx + 8]
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x40], eax
test rcx, rcx
je 0x100111796
cmp rcx, 0xffffffffffffffff
jne 0x100111798
xor ecx, ecx
neg r9d
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x60]
sbb rax, rax
and rax, r8
mov r8d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001117d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001117e8
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1001117e2
cmp dword [rsp + 0x60], edi
je 0x10011181e
mov ebx, 0x8004e109
test ebx, ebx
jns 0x10011181e
jmp 0x1001117ed
mov ebx, 0x80004005
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x10011181e
test byte [rcx + 0x3c], 2
je 0x10011181e
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020478]
mov edx, 0x16
mov r9d, ebx
call fcn.100050618
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x10011182c
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x20
mov rcx, rdx
mov rdi, rdx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100111922
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbp, [0x100331948]
cmp eax, 5
jne 0x100111876
lea edx, [rbx + 1]
mov rcx, rdi
call fcn.1000b1430
mov ebx, eax
test eax, eax
js 0x100111893
jmp 0x10011188f
test eax, eax
jne 0x100111881
mov ebx, 0x80004005
jmp 0x100111893
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x1001118bd
mov rcx, qword [0x100331948]
cmp rcx, rbp
je 0x1001118c4
test byte [rcx + 0x3c], 2
je 0x1001118c4
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020478]
mov edx, 0x1e
mov r9d, ebx
call fcn.100050618
mov rcx, qword [0x100331948]
test ebx, ebx
js 0x1001118ff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1001118f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1001118e6
mov ebx, 0x80004005
jmp 0x1001118f8
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x100111922
mov rcx, qword [0x100331948]
cmp rcx, rbp
je 0x100111922
test byte [rcx + 0x3c], 2
je 0x100111922
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020478]
mov edx, 0x1f
mov r9d, ebx
call fcn.100050618
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1001119b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov esi, r8d
mov r12, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [rbp + 0x68], 0
mov dword [rbp + 0x68], 1
mov edi, eax
mov eax, dword [0x100349b08]
lea r14, [0x100331948]
cmove eax, edi
xor ebx, ebx
mov dword [0x100349b08], eax
mov rax, qword [rbp + 8]
test rax, rax
je 0x100111a60
cmp rax, 0xffffffffffffffff
je 0x100111a60
test rax, rax
je 0x100111a60
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x100111a1b
xor ecx, ecx
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov r8d, esi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100111a4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100111a60
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100111a5a
cmp dword [rsp + 0x50], esi
je 0x100111a8f
mov ebx, 0x8004e10a
test ebx, ebx
js 0x100111a65
jmp 0x100111a8f
mov ebx, 0x80004005
mov rcx, qword [0x100331948]
cmp rcx, r14
je 0x100111a96
test byte [rcx + 0x3c], 2
je 0x100111a96
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020478]
mov edx, 0x17
mov r9d, ebx
call fcn.100050618
mov rcx, qword [0x100331948]
test ebx, ebx
js 0x100111ae7
cmp qword [rbp + 0x60], 0
je 0x100111ae3
sub edi, dword [0x100349b08]
mov eax, 0x1d4c0
cmp edi, eax
jae 0x100111ab4
sub eax, edi
jmp 0x100111ab6
xor eax, eax
mov rdx, qword [rbp + 0x60]
mov rcx, qword [0x100347af0]
mov r8d, 0x4e20
cmp eax, r8d
mov r9d, 0xfffffffe
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov rcx, qword [0x100331948]
xor ebx, ebx
test ebx, ebx
jns 0x100111b0a
cmp rcx, r14
je 0x100111b0a
test byte [rcx + 0x3c], 2
je 0x100111b0a
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020478]
mov edx, 0x29
mov r9d, ebx
call fcn.100050618
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x10011527c
Capabilities:
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x20], 0
mov rdi, rcx
jne 0x10011529b
xor ebx, ebx
jmp 0x1001153c4
lea rdx, [rsp + 0x30]
call fcn.100111b28
lea rsi, [0x100331948]
mov ebx, eax
test eax, eax
js 0x10011539a
xor edx, edx
mov rcx, rdi
call fcn.100110c2c
mov rdx, qword [rdi + 0x18]
mov rcx, rdi
call fcn.10011182c
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1001152f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1001153d6
mov ebx, 0x80004005
jmp 0x10011539a
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x18]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1001152e1
mov rbx, qword [rdi + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10011532f
bts eax, 0xd
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r9, qword [rdi + 0x10]
mov edx, 0xc0000000
mov r8d, 4
mov rcx, rdi
call fcn.100116a70
mov ebx, eax
test eax, eax
jns 0x100115376
mov rcx, qword [0x100331948]
cmp rcx, rsi
je 0x10011537d
test byte [rcx + 0x3c], 2
je 0x10011537d
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020478]
mov edx, 0x1c
mov r9d, eax
call fcn.100050618
mov rcx, qword [0x100331948]
test ebx, ebx
js 0x1001153a1
mov edx, dword [rsp + 0x30]
and dword [rdi + 0x20], 0
xor r8d, r8d
mov rcx, rdi
call fcn.100111620
mov ebx, eax
test ebx, ebx
jns 0x1001153c4
mov rcx, qword [0x100331948]
cmp rcx, rsi
je 0x1001153c4
test byte [rcx + 0x3c], 2
je 0x1001153c4
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020478]
mov edx, 0x18
mov r9d, ebx
call fcn.100050618
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100115396
Function at 0x1001160d8
Capabilities:
Access the windows event log

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x50
movzx ebp, dx
lea rdx, [0x100040500]
xor r12d, r12d
xor ecx, ecx
mov esi, r8d
mov edi, r12d
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
cmp rax, r12
jne 0x100116119
mov rbx, r12
jmp 0x10011614a
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
xor r8d, r8d
mov r9d, esi
movzx edx, bp
mov rcx, rax
mov word [rsp + 0x28], r12w
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp eax, r12d
jne 0x1001161a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, r12d
jne 0x10011615c
mov edi, 0x80004005
jmp 0x100116170
movzx edi, ax
or edi, 0x80070000
cmp eax, r12d
cmovle edi, eax
cmp edi, r12d
jge 0x1001161a1
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x1001161a1
test byte [rcx + 0x3c], 2
je 0x1001161a1
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020478]
mov edx, 0x19
mov r9d, edi
call fcn.100050618
cmp rbx, r12
je 0x1001161af
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, edi
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret