joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002f40
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
mov r11, rsp
sub rsp, 0xa8
mov rax, qword [0x1001b2a8]
mov qword [rsp + 0x78], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov rbx, rcx
mov rcx, qword [rcx + 0x130]
mov esi, r8d
mov rbp, rdx
lea r9, [r11 - 0x54]
mov r8d, 0x80
mov edx, 0xffff
mov qword [r11 - 0x20], r12
mov word [rsp + 0x54], 1
mov word [rsp + 0x56], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x130]
call qword [sym.imp.KERNEL32.dll_CancelIo]
xor r12d, r12d
mov eax, r12d
xchg dword [rbx + 0x145], eax
mov rcx, qword [rbx + 0x130]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rbx + 0x138]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x138]
mov qword [rbx + 0x130], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov byte [rbx + 0x145], r12b
mov eax, dword [0x1001b2c0]
test eax, eax
je 0x10003007
cmp eax, 4
je 0x10003007
cmp eax, 5
jne 0x10003026
mov edx, 1
lea ecx, [rdx + 1]
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov qword [rbx + 0x130], rax
jne 0x1000302d
xor al, al
jmp 0x1000319a
cmp dword [0x1001b2c0], r12d
mov qword [rsp + 0x90], rdi
je 0x10003050
lea rcx, [0x1001b2d0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rdi, rax
jmp 0x1000305c
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rdi, rax
test rdi, rdi
jne 0x10003068
xor al, al
jmp 0x10003192
cmp dword [0x1001b2c0], r12d
mov word [rsp + 0x68], 2
je 0x1000308c
movzx ecx, word [section..data]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x6a], ax
jmp 0x1000309a
movzx ecx, si
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x6a], ax
mov rax, qword [rdi + 0x18]
lea rdx, [rsp + 0x68]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, qword [rax]
mov eax, dword [rcx]
mov rcx, qword [rbx + 0x130]
mov dword [rsp + 0x6c], eax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10003061
cmp dword [0x1001b2c0], 5
jne 0x100030df
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.10002050
test al, al
je 0x10003061
mov rcx, qword [rbx + 0x130]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 8
mov byte [rsp + 0x50], 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10003160
mov rcx, qword [rbx + 0x130]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x58]
mov r9d, recv
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x5c], 0x2bf20
mov dword [rsp + 0x60], 0x1388
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov byte [rsp + 0x30], 1
lea r8, [0x10002d90]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov byte [rbx + 0x145], 1
mov dword [rsp + 0x20], r12d
call fcn.1000a5c0
mov qword [rbx + 0x128], rax
mov al, 1
mov rdi, qword [rsp + 0x90]
mov r12, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x78]
call fcn.100120f0
add rsp, 0xa8
ret
Function at 0x100031d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
movsxd rcx, eax
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1000333e
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rbx, rdi
mov qword [rsp + 0x20], rdi
cmp byte [rdi], 0x5c
jne 0x1000328e
lea rax, [rdi + 1]
cmp byte [rax], 0x5c
jne 0x1000328e
mov qword [rsp + 0x20], rax
lea rbx, [rax + 1]
mov qword [rsp + 0x20], rbx
movzx eax, byte [rbx]
test al, al
je 0x10003254
cmp al, 0x5c
je 0x10003254
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextA]
mov rbx, rax
mov qword [rsp + 0x20], rax
jmp 0x10003236
cmp byte [rbx], 0
je 0x10003261
inc rbx
mov qword [rsp + 0x20], rbx
movzx eax, byte [rbx]
test al, al
je 0x1000327f
cmp al, 0x5c
je 0x1000327f
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextA]
mov rbx, rax
mov qword [rsp + 0x20], rax
jmp 0x10003261
cmp byte [rbx], 0
je 0x100032b8
inc rbx
mov qword [rsp + 0x20], rbx
jmp 0x100032b8
lea rax, [rdi + 1]
cmp byte [rax], 0x3a
jne 0x100032b8
mov qword [rsp + 0x20], rax
lea rbx, [rax + 1]
mov qword [rsp + 0x20], rbx
movzx eax, byte [rbx]
test al, al
je 0x100032b8
cmp al, 0x5c
jne 0x100032b8
inc rbx
mov qword [rsp + 0x20], rbx
movzx eax, byte [rbx]
test al, al
je 0x10003324
cmp al, 0x5c
jne 0x10003311
mov byte [rbx], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100032fd
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000330e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000330e
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
xor al, al
jmp 0x1000333e
test al, 0x10
jne 0x1000330e
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
xor al, al
jmp 0x1000333e
mov byte [rbx], 0x5c
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextA]
mov rbx, rax
mov qword [rsp + 0x20], rax
jmp 0x100032b8
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov al, 1
jmp 0x1000333e
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x38
ret
Function at 0x10003350
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x418
mov rax, qword [0x1001b2a8]
mov qword [rsp + 0x400], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rdi
mov edi, r8d
mov rbx, rdx
lea rcx, [r11 - 0x328]
mov r8d, 0x104
xor edx, edx
mov dword [rsp + 0x50], 0x104
call sub.msvcrt.dll_memset
mov edx, 0x2e
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strrchr]
test rax, rax
je 0x10003458
lea rcx, [rsp + 0x58]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000000
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003458
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0xf0]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8d, 0x1f4
call sub.msvcrt.dll_memset
lea r8, [rsp + 0xf0]
lea rdx, str._s_shellopencommand
lea rcx, [rsp + 0x200]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r11, [rsp + 0x58]
lea rdx, [rsp + 0x200]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000345f
xor al, al
jmp 0x10003576
lea rcx, [rsp + 0xf0]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0xf0]
xor edx, edx
mov dword [rsp + 0x50], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x100138c0]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x100034fd
lea rdx, [0x100138bc]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x100034fd
lea rdx, [0x100138b8]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0xf0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x10003509
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edx, edx
lea rcx, [rsp + 0x68]
lea r8d, [rdx + 0x60]
call sub.msvcrt.dll_memset
test edi, edi
lea rax, str.WinSta0Default
cmove rax, qword [rsp + 0x70]
lea rdx, [rsp + 0xf0]
xor r9d, r9d
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xd0]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x60], 0x68
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdi, qword [rsp + 0x410]
mov rbx, qword [rsp + 0x438]
mov rcx, qword [rsp + 0x400]
call fcn.100120f0
add rsp, 0x418
ret
Function at 0x100035a0
Capabilities:
Get disk information
Get disk size
Get file system object information

Disassembly:
mov r11, rsp
sub rsp, 0x808
mov rax, qword [0x1001b2a8]
mov qword [rsp + 0x7d0], rax
mov qword [r11 + 0x18], rbp
mov qword [r11 - 8], rdi
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
mov r15, rcx
lea rdx, [r11 - 0x538]
mov ecx, 0x100
mov byte [rsp + 0x3d0], 0x67
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor edi, edi
lea rbp, [rsp + 0x2d0]
cmp byte [rsp + 0x2d0], dil
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
lea r14d, [rdi + 1]
je 0x100037aa
mov qword [rsp + 0x818], rbx
mov qword [rsp + 0x828], rsi
mov qword [rsp + 0x7f8], r12
mov qword [rsp + 0x7f0], r13
nop
lea rcx, [rsp + 0x1c0]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea r8, [rsp + 0x50]
mov r9d, 0x168
mov edx, 0x80
mov rcx, rbp
mov dword [rsp + 0x20], 0x410
call qword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea rcx, [rsp + 0x164]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x1c0]
lea r12d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movzx ecx, byte [rbp]
cmp cl, 0x41
lea r13d, [rax + 1]
je 0x100036f6
cmp cl, 0x42
je 0x100036f6
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x100036f6
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
shr rbx, 0x14
shr rsi, 0x14
jmp 0x100036fa
mov ebx, edi
mov esi, edi
movzx eax, byte [rbp]
mov edi, r14d
mov rcx, rbp
mov byte [rsp + rdi + 0x3d0], al
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea ecx, [r14 + 1]
mov dword [rsp + rdi + 0x3d2], ebx
mov byte [rsp + rcx + 0x3d0], al
movsxd rbx, r12d
lea rcx, [rsp + rdi + 0x3da]
lea rdx, [rsp + 0x164]
mov r8, rbx
mov dword [rsp + rdi + 0x3d6], esi
call sub.msvcrt.dll_memcpy
lea rax, [rbx + rdi]
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + rax + 0x3da]
movsxd r8, r13d
call sub.msvcrt.dll_memcpy
lea r11d, [r13 + r12]
mov rcx, rbp
lea r14d, [r14 + r11 + 0xa]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, 0
inc eax
cdqe
add rbp, rax
cmp byte [rbp], 0
jne 0x10003630
mov r13, qword [rsp + 0x7f0]
mov r12, qword [rsp + 0x7f8]
mov rsi, qword [rsp + 0x828]
mov rbx, qword [rsp + 0x818]
lea rdx, [rsp + 0x3d0]
mov r8d, r14d
mov rcx, r15
call fcn.10005c00
mov r15, qword [rsp + 0x7e0]
mov r14, qword [rsp + 0x7e8]
mov rdi, qword [rsp + 0x800]
mov rbp, qword [rsp + 0x820]
mov rcx, qword [rsp + 0x7d0]
call fcn.100120f0
add rsp, 0x808
ret
Function at 0x100039f0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov r11, rsp
sub rsp, 0x398
mov rax, qword [0x1001b2a8]
mov qword [rsp + 0x380], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov r8, rdx
mov rsi, rcx
mov rbx, rdx
lea rcx, [r11 - 0x128]
lea rdx, str._s.
mov qword [r11 - 8], rdi
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x10003a55
xor al, al
jmp 0x10003ae6
cmp byte [rsp + 0x4c], 0x2e
je 0x10003abd
test byte [rsp + 0x20], 0x10
je 0x10003a92
lea r9, [rsp + 0x4c]
lea rdx, str._s_s
lea rcx, [rsp + 0x160]
mov r8, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x160]
mov rcx, rsi
call fcn.100039f0
jmp 0x10003abd
lea r9, [rsp + 0x4c]
lea rdx, str._s_s
lea rcx, [rsp + 0x160]
mov r8, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10003a55
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne al
mov rdi, qword [rsp + 0x390]
mov rsi, qword [rsp + 0x3b8]
mov rbx, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x380]
call fcn.100120f0
add rsp, 0x398
ret
Function at 0x10003b20
Capabilities:
Get file size

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x70], rbx
lea rbx, [rcx + 0x3c]
mov qword [rsp + 0x60], r12
mov r12, rdx
mov qword [rsp + 0x58], r13
mov r13, rcx
mov rcx, rbx
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
mov r11, r12
sub rbx, r12
nop
nop
nop
nop
movzx eax, byte [r11]
inc r11
test al, al
mov byte [rbx + r11 - 1], al
jne 0x10003b60
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x10003bbd
xor eax, eax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
mov qword [rsp + 0x78], rbp
lea rdx, [rsp + 0x40]
mov rcx, rax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x40
lea ebp, [rax + 0xa]
movsxd rbx, ebp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rsi, rax
call sub.msvcrt.dll_memset
mov byte [rsi], 0x69
mov ecx, dword [rsp + 0x40]
mov dword [rsi + 1], ecx
mov rcx, r12
mov dword [rsi + 5], edi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsi + 9]
mov rdx, r12
inc eax
movsxd r8, eax
call sub.msvcrt.dll_memcpy
mov r8d, ebp
mov rdx, rsi
mov rcx, r13
call fcn.10005c00
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x10004070
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rbx, qword [rax]
mov rdi, rcx
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
lea rcx, [rbx + 0x10]
mov qword [rdx], rax
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
dec qword [rdi + 0x30]
cmp qword [rdi + 0x30], 0
mov rbx, qword [rsp + 0x40]
jne 0x100040e1
lea rdx, [rsp + 0x30]
mov r8d, 1
mov rcx, rdi
mov byte [rsp + 0x30], 0x6b
call fcn.10005c00
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
mov rax, qword [rdi + 0x28]
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x18]
mov rcx, rdi
test rdx, rdx
cmove rdx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
jmp fcn.10003b20
Function at 0x10004550
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov r11, rsp
sub rsp, 0x408
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov rax, qword [0x1001b2a8]
mov qword [rsp + 0x3e0], rax
mov rbx, rdx
mov qword [rsp + 0x38], rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x104
lea rcx, [r11 - 0x138]
call sub.msvcrt.dll_memset
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r8, eax
lea rdi, [0x1001397c]
lea rax, [0x10013978]
cmp byte [r8 + rbx - 1], 0x5c
cmove rdi, rax
mov qword [rsp + 0x40], rdi
mov r9, rdi
mov r8, rbx
lea rdx, str._s_s.
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x10004610
xor al, al
jmp 0x10004736
cmp byte [rsp + 0xac], 0x2e
je 0x10004712
test byte [rsp + 0x80], 0x10
je 0x10004665
lea rax, [rsp + 0xac]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rbx
lea rdx, str._s_s_s
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x1c0]
mov rcx, rsi
call fcn.10004550
jmp 0x10004712
lea rax, [rsp + 0xac]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rbx
lea rdx, str._s_s_s
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov byte [rsp + 0x30], al
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64__class_std::allocator_char__const____ptr64____ptr64]
nop
mov rdi, qword [rsi + 0x28]
mov rbx, qword [rdi + 8]
mov ecx, gethostbyname
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rax], rdi
mov rcx, rax
test rbx, rbx
cmovne rcx, rbx
mov qword [rax + 8], rcx
mov qword [rdi + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x58], rcx
test rcx, rcx
je 0x100046f9
lea rdx, [rsp + 0x60]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
nop
inc qword [rsi + 0x30]
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10004610
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov rcx, qword [rsp + 0x3e0]
call fcn.100120f0
mov rbx, qword [rsp + 0x420]
mov rbp, qword [rsp + 0x428]
mov rsi, qword [rsp + 0x400]
mov rdi, qword [rsp + 0x3f8]
add rsp, 0x408
ret
Function at 0x100052e0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
sub rsp, 0xe8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov edx, 0x2f
mov rdi, rcx
call qword [sym.imp.msvcrt.dll_strrchr]
mov rbx, rax
inc rbx
je 0x10005317
mov rdx, rbx
mov rcx, rdi
call fcn.1000a370
test al, al
jne 0x1000531b
xor al, al
jmp 0x10005385
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x60]
call sub.msvcrt.dll_memset
lea rax, str.WinSta0Default
lea rdx, str.ComeniusUpdate
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor eax, eax
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne al
mov rdi, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x100]
add rsp, 0xe8
ret

Function at 0x10005700
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
lea rax, [0x10013b20]
mov qword [rsp + 0x40], rsi
xor esi, esi
mov rbx, rcx
mov qword [rcx], rax
cmp dword [rcx + 0x13aa0], esi
jbe 0x1000575b
mov qword [rsp + 0x48], rdi
lea rdi, [rcx + 0x220]
mov rcx, qword [rdi]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
add rdi, 8
cmp esi, dword [rbx + 0x13aa0]
jb 0x10005731
mov rdi, qword [rsp + 0x48]
mov rcx, rbx
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
jmp fcn.10005bd0

Function at 0x10005780
Capabilities:
Move file

Disassembly:
sub rsp, 0x368
mov rax, qword [0x1001b2a8]
mov qword [rsp + 0x350], rax
mov qword [rsp + 0x380], rbx
mov rbx, rcx
lea rcx, str.wmiapsrv.exe
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100058b4
lea rcx, [rsp + 0x130]
xor edx, edx
mov r8d, 0x104
mov qword [rsp + 0x388], rdi
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x240]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
mov rcx, qword [0x1001b808]
lea rdx, [rsp + 0x130]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
lea rdi, [rsp + 0x130]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 0xd]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_memcpy
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, str._d.tmp
lea rcx, [rsp + 0x240]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
xor r8d, r8d
lea r9, [rbx + 0x120]
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rdi, qword [rsp + 0x388]
mov rbx, qword [rsp + 0x380]
mov rcx, qword [rsp + 0x350]
call fcn.100120f0
add rsp, 0x368
ret
Function at 0x10006350
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
mov r11, rsp
sub rsp, 0x88
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov esi, r9d
mov r13, r8
mov rdi, rdx
mov r12, rcx
xor ebx, ebx
mov ecx, dword [rsp + 0xc0]
test ecx, ecx
je 0x10006426
dec ecx
je 0x10006462
dec ecx
je 0x100063e4
dec ecx
jne 0x10006503
lea rax, [r11 - 0x30]
mov qword [r11 - 0x68], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006503
mov rdx, r13
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10006503
lea ebx, [rax + 1]
jmp 0x10006503
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006503
mov rdx, r13
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x10006503
lea ebx, [rax + 1]
jmp 0x10006503
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10006503
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006503
test esi, esi
je 0x10006503
cmp esi, 2
jbe 0x100064c1
cmp esi, 4
jne 0x10006503
mov dword [rsp + 0x28], esi
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10006503
lea ebx, [rsi - 3]
jmp 0x10006503
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdx, qword [rsp + 0xb0]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdx
mov r9d, esi
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x68]
mov r13, qword [rsp + 0x60]
add rsp, 0x88
ret