joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b720
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1400732e8]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r10, rcx
mov dword [rsp + 0x20], 0x70
movzx ecx, byte [rsp + 0x2e8]
lea rax, str.open
test cl, cl
mov dword [rsp + 0x24], 0x40
mov rbx, r8
mov qword [rsp + 0x38], r10
lea r8, str.runas
mov qword [rsp + 0x40], rdx
cmovne rax, r8
movzx edi, r9b
mov qword [rsp + 0x30], rax
xor eax, eax
cmp byte [rsp + 0x2e0], al
mov qword [rsp + 0x28], rax
sete al
mov dword [rsp + 0x50], eax
test rbx, rbx
jne 0x14000b7bb
test r10, r10
je 0x14000b7bb
lea rdx, [rsp + 0x90]
mov rcx, r10
lea rbx, [rsp + 0x90]
call fcn.14000d8f0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
test dil, dil
je 0x14000b7ef
test bl, bl
je 0x14000b7ef
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14000b7ef
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx eax, bl
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140015a80
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2b0
pop rdi
ret

Function at 0x14000bd40
Capabilities:
Copy file
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, 0x410
mov rbp, rdx
or word [rcx + 0x20], ax
mov rdi, rcx
movzx eax, word [rcx + 0x20]
test r8d, r8d
je 0x14000bd72
or ax, 0x40
mov word [rcx + 0x20], ax
mov rax, qword [rdx + 0x28]
xor esi, esi
mov ebx, esi
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000bda5
cmp byte [rax + 0x1c], sil
je 0x14000bda5
mov ecx, dword [rax + 0x30]
inc ecx
add ebx, ecx
lea rcx, [rsp + 0x40]
call fcn.140002ac0
mov rax, qword [rsp + 0x40]
jmp 0x14000bd82
lea eax, [rbx + 1]
mov rcx, 0xffffffffffffffff
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140015d4c
lea r8, [rbx + rbx]
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.140036a80
mov rax, qword [rbp + 0x28]
mov ebx, esi
lea rbp, [0x140075940]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
nop dword [rax]
test rax, rax
je 0x14000be2a
cmp byte [rax + 0x1c], sil
je 0x14000be2a
mov rcx, qword [rax + 0x28]
mov rdx, rbp
test rcx, rcx
movsxd rax, ebx
cmovne rdx, rcx
lea rcx, [r14 + rax*2]
call fcn.140009420
inc eax
lea rcx, [rsp + 0x40]
add ebx, eax
call fcn.140002ac0
mov rax, qword [rsp + 0x40]
jmp 0x14000bdf0
mov rcx, rdi
mov dword [rdi + 8], 3
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], rsi
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edx, 2
mov rcx, r14
mov ebx, eax
call fcn.140016274
mov rbp, qword [rsp + 0x50]
test ebx, ebx
mov rbx, qword [rsp + 0x48]
sete al
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14000bfc0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1400732e8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, 0x400
mov r14d, r9d
or word [rcx + 0x20], ax
mov rbp, r8
cmp dword [rsp + 0x290], 0
mov rbx, rdx
movzx eax, word [rcx + 0x20]
mov rdi, rcx
je 0x14000c012
or ax, 8
mov word [rcx + 0x20], ax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140036a80
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140009420
mov rax, qword [rbp + 0x28]
xor ebx, ebx
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
nop
test rax, rax
je 0x14000c063
cmp byte [rax + 0x1c], 0
je 0x14000c063
mov ecx, dword [rax + 0x30]
inc ecx
add ebx, ecx
lea rcx, [rsp + 0x20]
call fcn.140002ac0
mov rax, qword [rsp + 0x20]
jmp 0x14000c040
lea eax, [rbx + 1]
mov rcx, 0xffffffffffffffff
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140015d4c
lea r8, [rbx + rbx]
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.140036a80
mov rcx, qword [rbp + 0x28]
xor ebx, ebx
lea rbp, [0x140075940]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rcx
nop word [rax + rax]
test rcx, rcx
je 0x14000c0ea
cmp byte [rcx + 0x1c], 0
je 0x14000c0ea
mov rax, qword [rcx + 0x28]
mov rdx, rbp
test rax, rax
cmovne rdx, rax
movsxd rax, ebx
lea rcx, [rsi + rax*2]
call fcn.140009420
inc eax
lea rcx, [rsp + 0x20]
add ebx, eax
call fcn.140002ac0
mov rcx, qword [rsp + 0x20]
jmp 0x14000c0b0
neg r14d
mov qword [rdi + 0x10], rsi
mov rcx, rdi
sbb eax, eax
add eax, 2
mov dword [rdi + 8], eax
lea rax, [rsp + 0x30]
mov qword [rdi + 0x18], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edx, 2
mov rcx, rsi
mov ebx, eax
call fcn.140016274
test ebx, ebx
jne 0x14000c127
cmp dword [rdi + 0x24], ebx
jne 0x14000c127
mov al, 1
jmp 0x14000c129
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140015a80
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000cdb0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rdx, r8
mov rbx, rcx
xor r9d, r9d
mov r8, rcx
lea rcx, [0x14000c940]
call fcn.14000d840
mov r8, rbx
lea rdx, str.SoftwareRegisteredApplications
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea rdi, vtable.TString_wchar_t__8_.0
mov qword [rsp + 0x28], rdi
xor eax, eax
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
mov r8, rbx
lea rdx, str.Software_s
lea rcx, [rsp + 0x28]
call fcn.1400074b0
lea rdx, [0x140075940]
mov rax, qword [rsp + 0x30]
test rax, rax
cmovne rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
nop
mov qword [rsp + 0x28], rdi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000ce64
cmp dword [rsp + 0x3c], 0
je 0x14000ce64
mov edx, 2
call fcn.140016274
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x14000d160
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xb00
mov rax, qword [0x1400732e8]
xor rax, rsp
mov qword [rsp + 0xaf0], rax
mov rbp, qword [rsp + 0xb50]
xor eax, eax
movzx r14d, r8b
mov qword [rsp + 0x50], rax
mov rdi, rdx
mov qword [rsp + 0x58], rax
mov rsi, rcx
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x68]
xor edx, edx
lea rcx, [rsp + 0x70]
movzx ebx, r9b
call fcn.140036a80
xor r15d, r15d
mov dword [rsp + 0x70], 0x68
test bl, bl
mov dword [rsp + 0xac], 1
mov eax, r15d
sete al
mov word [rsp + 0xb0], ax
test rbp, rbp
jne 0x14000d204
test rsi, rsi
je 0x14000d204
lea rdx, [rsp + 0xe0]
mov rcx, rsi
lea rbp, [rsp + 0xe0]
call fcn.14000d8f0
test rdi, rdi
je 0x14000d24e
test rsi, rsi
je 0x14000d238
cmp word [rdi], 0x20
je 0x14000d238
lea rdx, [0x140059694]
lea rcx, [rsp + 0x2f0]
call fcn.140009420
mov r8d, 0x3ff
lea rcx, [rsp + 0x2f2]
jmp 0x14000d246
mov r8d, 0x400
lea rcx, [rsp + 0x2f0]
mov rdx, rdi
call fcn.140001eb0
lea rax, [rsp + 0x50]
test rdi, rdi
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x2f0]
cmove rdx, r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rbp
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
test r14b, r14b
je 0x14000d2b0
test bl, bl
je 0x14000d2b0
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx eax, bl
mov rcx, qword [rsp + 0xaf0]
xor rcx, rsp
call fcn.140015a80
mov rbx, qword [rsp + 0xb40]
add rsp, 0xb00
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000e130
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov r10d, r9d
xor ebx, ebx
sub r10d, 1
je 0x14000e152
cmp r10d, 3
je 0x14000e14b
mov eax, ebx
jmp 0x14000e15f
mov eax, 4
jmp 0x14000e15f
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], bl
jne 0x14000e156
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
add rsp, 0x30
pop rbx
ret

Function at 0x14000e3f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], 0x800
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x14000e640
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
sete al
add rsp, 0x28
ret
Function at 0x14000ea80
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400732e8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r8, rcx
mov edx, 0x100
lea rcx, [rsp + 0x40]
call fcn.1400380a8
mov edx, 0x5c
lea rcx, [rsp + 0x40]
call fcn.140036dec
mov edx, 0x5c
lea rcx, [rsp + 0x40]
mov rdi, rax
call fcn.140036e80
xor ecx, ecx
lea r8, [rsp + 0x40]
mov word [rdi], cx
lea r9, [0x14005a030]
mov rbx, rax
mov edx, ecx
mov word [rax], cx
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x14000eb12
cmp rdx, 5
jne 0x14000eaf0
mov rcx, 0xffffffff80000000
jmp 0x14000ec2c
mov rdx, rcx
lea r8, [rsp + 0x40]
lea r9, [0x14005a040]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x14000eb52
cmp rdx, 5
jne 0x14000eb30
mov rcx, 0xffffffff80000001
jmp 0x14000ec2c
mov rdx, rcx
lea r8, [rsp + 0x40]
lea r9, [0x14005a050]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x14000eb92
cmp rdx, 5
jne 0x14000eb70
mov rcx, 0xffffffff80000002
jmp 0x14000ec2c
mov rdx, rcx
lea r8, [rsp + 0x40]
lea r9, [0x14005a060]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x14000ebcf
cmp rdx, 4
jne 0x14000ebb0
mov rcx, 0xffffffff80000003
jmp 0x14000ec2c
mov rdx, rcx
lea r8, [rsp + 0x40]
lea r9, [0x14005a068]
nop
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x14000ebff
cmp rdx, 5
jne 0x14000ebe0
mov rcx, 0xffffffff80000005
jmp 0x14000ec2c
lea rdx, [rsp + 0x40]
lea r8, [0x14005a078]
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000ec6b
cmp rcx, 5
jne 0x14000ec10
mov rcx, 0xffffffff80000006
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 2]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ec6b
mov rcx, qword [rsp + 0x30]
lea rdx, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x14000ec8e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140015a80
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14000ec6d

Function at 0x14000eca0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov r10d, r9d
xor ebx, ebx
sub r10d, 1
je 0x14000ecc2
cmp r10d, 3
je 0x14000ecbb
mov eax, ebx
jmp 0x14000ecd2
mov eax, 4
jmp 0x14000ecd2
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], bx
jne 0x14000ecc6
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
add rsp, 0x30
pop rbx
ret
Function at 0x14000ed00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1400732e8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov dword [rsp + 0x30], r8d
mov rsi, rdx
mov r8, rcx
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.1400380a8
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.140036dec
mov edx, 0x5c
lea rcx, [rsp + 0x50]
mov rdi, rax
call fcn.140036e80
xor ecx, ecx
lea r8, [rsp + 0x50]
mov word [rdi], cx
lea r9, [0x140059f80]
mov rbx, rax
mov edx, ecx
mov word [rax], cx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x14000eda2
cmp rdx, 5
jne 0x14000ed80
mov rcx, 0xffffffff80000000
jmp 0x14000eebc
mov rdx, rcx
lea r8, [rsp + 0x50]
lea r9, [0x140059f90]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x14000ede2
cmp rdx, 5
jne 0x14000edc0
mov rcx, 0xffffffff80000001
jmp 0x14000eebc
mov rdx, rcx
lea r8, [rsp + 0x50]
lea r9, [0x140059fa0]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x14000ee22
cmp rdx, 5
jne 0x14000ee00
mov rcx, 0xffffffff80000002
jmp 0x14000eebc
mov rdx, rcx
lea r8, [rsp + 0x50]
lea r9, [0x140059fb0]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x14000ee5f
cmp rdx, 4
jne 0x14000ee40
mov rcx, 0xffffffff80000003
jmp 0x14000eebc
mov rdx, rcx
lea r8, [rsp + 0x50]
lea r9, [0x140059fb8]
nop
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [r9 + rdx*2 - 2]
jne 0x14000ee8f
cmp rdx, 5
jne 0x14000ee70
mov rcx, 0xffffffff80000005
jmp 0x14000eebc
lea rdx, [rsp + 0x50]
lea r8, [0x140059fc8]
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000ef12
cmp rcx, 5
jne 0x14000eea0
mov rcx, 0xffffffff80000006
lea rax, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 2]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ef12
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14000ef2f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140015a80
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
jmp 0x14000ef14
Function at 0x14000ef50
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x278
mov rax, qword [0x1400732e8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov esi, r8d
mov rdi, rdx
mov r8, rcx
mov edx, 0x100
lea rcx, [rsp + 0x60]
mov ebp, r9d
call fcn.1400380a8
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call fcn.140036dec
mov edx, 0x5c
lea rcx, [rsp + 0x60]
mov r14, rax
call fcn.140036e80
xor ebx, ebx
lea rdx, [rsp + 0x60]
mov word [r14], bx
lea r8, [0x140059fd8]
mov r15, rax
mov ecx, ebx
mov word [rax], bx
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000eff1
cmp rcx, 5
jne 0x14000efd0
mov rcx, 0xffffffff80000000
jmp 0x14000f0e0
mov rcx, rbx
lea rdx, [rsp + 0x60]
lea r8, [0x140059fe8]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000f021
cmp rcx, 5
jne 0x14000f000
mov rcx, 0xffffffff80000001
jmp 0x14000f0e0
mov rcx, rbx
lea rdx, [rsp + 0x60]
lea r8, [0x140059ff8]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000f051
cmp rcx, 5
jne 0x14000f030
mov rcx, 0xffffffff80000002
jmp 0x14000f0e0
mov rcx, rbx
lea rdx, [rsp + 0x60]
lea r8, [0x14005a008]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000f07e
cmp rcx, 4
jne 0x14000f060
mov rcx, 0xffffffff80000003
jmp 0x14000f0e0
mov rcx, rbx
lea rdx, [rsp + 0x60]
lea r8, [0x14005a010]
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000f0ae
cmp rcx, 5
jne 0x14000f090
mov rcx, 0xffffffff80000005
jmp 0x14000f0e0
mov rax, rbx
lea rdx, [rsp + 0x60]
lea r8, [0x14005a020]
nop dword [rax]
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [r8 + rax*2 - 2]
jne 0x14000f183
cmp rax, 5
jne 0x14000f0c0
mov rcx, 0xffffffff80000006
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [r14 + 2]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000f183
test ebp, ebp
jne 0x14000f154
mov ecx, esi
sub ecx, 1
je 0x14000f135
sub ecx, 3
je 0x14000f12e
cmp ecx, 7
jne 0x14000f156
lea ebx, [rax + 8]
jmp 0x14000f156
mov ebx, 4
jmp 0x14000f156
or rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rdi + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x14000f140
lea ebx, [rax*2 + 2]
jmp 0x14000f156
mov ebx, ebp
mov rcx, qword [rsp + 0x50]
lea rdx, [r15 + 2]
mov dword [rsp + 0x28], ebx
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14000f1a5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140015a80
add rsp, 0x278
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14000f185
Function at 0x140011330
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov rdi, rcx
xor r8d, r8d
lea rcx, str.Mozilla_4.0__compatible__MSIE_8.0__Windows_NT_5.1__Trident_4.0__.NET4.0C__.NET4.0E__.NET_CLR_2.0.50727_
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
je 0x1400113ba
mov rax, qword [rdi]
lea rdx, [0x140075940]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x400
mov rcx, qword [rax + 8]
test rcx, rcx
cmovne rdx, rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
test rax, rax
jne 0x1400113c7
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400113ba
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 8]
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400113ec
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 8]
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140011b00
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1400732e8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
test rcx, rcx
je 0x140011b65
cmp word [rcx], 0
je 0x140011b65
lea rdx, [rsp + 0x20]
call fcn.14000d8f0
lea rcx, [rsp + 0x20]
call fcn.140012490
test al, al
jne 0x140011b53
cmp word [rsp + 0x20], 0
je 0x140011b53
lea rcx, [rsp + 0x20]
call fcn.140011b00
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
jmp 0x140011b67
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140015a80
add rsp, 0x240
pop rbx
ret

Function at 0x140011e20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
xor r8d, r8d
mov rdx, r9
mov rbx, rcx
call fcn.140011f80
cmp rax, 0xffffffffffffffff
jne 0x140011e5b
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140011ea0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov dword [rsp + 0x30], 0
mov rsi, rdx
xor r8d, r8d
mov rdx, r9
mov rbx, rcx
call fcn.140011f80
cmp rax, 0xffffffffffffffff
jne 0x140011ee3
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140011f20
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x58]
add rsp, 0x38
ret

Function at 0x140011fd0
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, qword [rsp + 0x38]
or rdx, 0xffffffffffffffff
test eax, eax
cmove rcx, rdx
mov rax, rcx
add rsp, 0x28
ret

Function at 0x140012050
Capabilities:
Copy file

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x14001207d
cmp word [rcx], 0
je 0x14001207d
test rdx, rdx
je 0x14001207d
cmp word [rdx], 0
je 0x14001207d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x140012090
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400120af
cmp word [rcx], 0
je 0x1400120af
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x140012490
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400124d0
cmp word [rcx], 0
je 0x1400124d0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400124c4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
setne al
add rsp, 0x20
pop rbx
ret
shr eax, 4
and eax, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400124e0
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400124ff
cmp word [rcx], 0
je 0x1400124ff
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x140012590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400125f2
cmp word [rcx], 0
je 0x1400125f2
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r8d, eax
cmp eax, 0xffffffff
jne 0x1400125b4
or eax, eax
add rsp, 0x28
ret
mov ecx, r8d
and ecx, 2
mov edx, ecx
or edx, 1
and al, 1
mov eax, r8d
cmove edx, ecx
mov ecx, edx
or ecx, 0x10
and al, 0x10
mov eax, r8d
cmove ecx, edx
mov edx, ecx
or edx, 4
and al, 4
cmove edx, ecx
mov eax, edx
or eax, 0x20
and r8d, 0x800
cmove eax, edx
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret