joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a88e0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rbp + 0x360], rax
xor eax, eax
mov rdi, r8
mov qword [rsp + 0x30], rax
mov rbx, rdx
mov qword [rsp + 0x38], rax
mov rsi, rcx
test rcx, rcx
je 0x1400a8ae4
test rdx, rdx
je 0x1400a8ae4
test r8, r8
je 0x1400a8ae4
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a8ae2
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a8ae2
mov r9, rbx
lea r8, [0x140339700]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14004ebd0
xor edx, edx
lea rax, [rsp + 0x30]
lea r9, [0x1402b5010]
mov qword [rsp + 0x20], rax
lea rcx, [0x140351950]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rsp + 0x30]
test eax, eax
js 0x1400a89b8
test rcx, rcx
je 0x1400a89b8
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
lea rdx, [0x1403518c0]
call qword [rax]
mov rcx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
test r9, r9
je 0x1400a8ad7
mov rax, qword [r9]
xor r8d, r8d
mov rdx, rsi
mov rcx, r9
call qword [rax + Ordinal_41]
test eax, eax
jne 0x1400a8ac2
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x208
call fcn.14027b2c0
mov rcx, qword [rsp + 0x30]
lea rdx, [rbp + 0x150]
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov r8d, 0x104
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
test eax, eax
jne 0x1400a8ac2
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x150]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400a8ac2
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x48]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400a8a50
lea rcx, [rbp + 0x150]
mov r9, rdi
lea rax, [rcx + rax*2]
mov edx, 0x104
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [0x140339710]
call fcn.14004ebd0
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x38]
mov r8d, 1
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400a8ad2
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400a8ae2
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
xor eax, eax
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14012a2b0
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x470
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a8bd0
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400a8cd7
test rdx, rdx
je 0x1400a8cd7
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a8cd7
xor eax, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea edx, [rax + 1]
lea r8d, [rax + 3]
mov rcx, rbx
call fcn.1400526c0
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400a8c69
lea r9, [rsp + 0x48]
mov r8, rbx
lea rdx, [0x1400a8b10]
mov rcx, rax
call fcn.140052980
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
mov rbx, qword [rsp + 0x48]
sub rax, rbx
sar rax, 5
test rax, rax
je 0x1400a8cb4
cmp rbx, rdx
je 0x1400a8cb4
cmp qword [rbx + 0x18], 8
jb 0x1400a8c93
mov rcx, qword [rbx]
jmp 0x1400a8c96
mov rcx, rbx
mov r8, rsi
mov rdx, rdi
call fcn.1400a88e0
add rbx, 0x20
mov rdx, qword [rsp + 0x50]
cmp rbx, rdx
jne 0x1400a8c87
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1400a8cd7
mov rcx, rbx
call fcn.1400568e0
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
sub r8, rdx
sar r8, 5
call fcn.140056760
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14012a2b0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a95a0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x320], rbx
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rbx, rdx
mov r14, rcx
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
je 0x1400a95f3
mov eax, 1
jmp 0x1400a9791
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a95e9
mov r8, r14
lea rdx, [0x140339768]
lea rcx, [rsp + 0x58]
call fcn.14004bec0
nop
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400a9772
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400a9768
xor r15d, r15d
test byte [rbp - 0x80], 0x10
jne 0x1400a9753
lea rdx, [0x140339778]
lea rcx, [rbp - 0x54]
call fcn.14027c4d8
test eax, eax
je 0x1400a9753
lea r9, [rbp - 0x54]
mov r8, r14
lea rdx, [0x140339818]
lea rcx, [rsp + 0x38]
call fcn.14004bec0
mov rdi, rax
lea rax, [rsp + 0x58]
cmp rax, rdi
je 0x1400a96db
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x1400a96b9
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.14004e2e0
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14004dec0
nop
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x1400a96f8
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.14004e2e0
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 8], rax
jne 0x1400a970a
mov rcx, rbx
call fcn.140056660
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
test rcx, rcx
je 0x1400a974e
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r15
cmp qword [rcx + 0x18], 8
jb 0x1400a9735
mov rax, qword [rcx]
jmp 0x1400a9738
mov rax, rcx
mov word [rax], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x58]
call fcn.14004e350
nop
add qword [rbx + 8], 0x20
lea rdx, [rbp - 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400a9655
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x1400a978f
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.14004e2e0
xor eax, eax
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14012a2b0
mov rbx, qword [rsp + 0x320]
add rsp, 0x2e0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a97c0
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x310], rbx
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
je 0x1400a9814
mov eax, 1
jmp 0x1400a9a02
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a980a
mov r8, rdi
lea rdx, [0x140339828]
lea rcx, [rsp + 0x60]
call fcn.14004bec0
nop
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400a99e3
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400a99d9
nop dword [rax]
nop word [rax + rax]
lea r9, [rbp - 0x54]
mov r8, rdi
lea rdx, [0x140339838]
lea rcx, [rsp + 0x40]
call fcn.14004bec0
mov rdi, rax
lea rax, [rsp + 0x60]
cmp rax, rdi
je 0x1400a98e5
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x1400a98c2
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.14004e2e0
mov qword [rsp + 0x78], 7
xor eax, eax
mov qword [rsp + 0x70], rax
mov word [rsp + 0x60], ax
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.14004dec0
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x1400a9902
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14004e2e0
lea rcx, [rbp - 0x54]
test byte [rbp - 0x80], 0x10
je 0x1400a9953
lea rdx, [0x140324f94]
call fcn.14027c4d8
test eax, eax
je 0x1400a99bf
lea rdx, [0x1403397d8]
lea rcx, [rbp - 0x54]
call fcn.14027c4d8
test eax, eax
je 0x1400a99bf
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
mov rdx, rbx
call fcn.1400a97c0
jmp 0x1400a99bf
lea rdx, [0x1403397e0]
call fcn.14027c4d8
test eax, eax
je 0x1400a99bf
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 8], rax
jne 0x1400a9975
mov rcx, rbx
call fcn.140056660
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
test rcx, rcx
je 0x1400a99ba
xor edx, edx
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rdx
cmp qword [rcx + 0x18], 8
jb 0x1400a99a2
mov rax, qword [rcx]
jmp 0x1400a99a5
mov rax, rcx
mov word [rax], dx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x60]
call fcn.14004e350
nop
add qword [rbx + 8], 0x20
lea rdx, [rbp - 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov rdi, qword [rsp + 0x20]
jne 0x1400a9880
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x1400a9a00
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.14004e2e0
xor eax, eax
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14012a2b0
mov rbx, qword [rsp + 0x310]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a9a30
Capabilities:
Copy file
Delete file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x470
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor ebp, ebp
mov r9, rdx
lea r8, [0x1403397f8]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14004ebd0
mov rbx, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, rbx
sar rax, 5
test rax, rax
je 0x1400a9bc4
cmp rbx, qword [rsi + 8]
je 0x1400a9bc4
cmp qword [rbx + 0x18], 8
jb 0x1400a9aaf
mov rcx, qword [rbx]
jmp 0x1400a9ab2
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test rax, rax
je 0x1400a9aef
lea rdx, [0x140339808]
mov rcx, rax
call fcn.14027c4d8
test eax, eax
jne 0x1400a9aef
cmp qword [rbx + 0x18], 8
jb 0x1400a9adc
mov rcx, qword [rbx]
jmp 0x1400a9adf
mov rcx, rbx
mov r8, r14
mov rdx, rdi
call fcn.1400a88e0
jmp 0x1400a9bb6
cmp qword [rbx + 0x18], 8
jb 0x1400a9afb
mov rcx, qword [rbx]
jmp 0x1400a9afe
mov rcx, rbx
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400a9bb6
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400a9b20
shl rax, 5
add rax, rbx
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, [0x1403398c0]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14004ebd0
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400a9b53
shl rax, 5
add rax, rbx
mov qword [rsp + 0x20], rax
lea r9, str.X:UsersAdministratorAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
lea r8, [0x1403398d0]
mov edx, 0x104
lea rcx, [rsp + 0x250]
call fcn.14004ebd0
xor r8d, r8d
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebp, eax
cmp qword [rbx + 0x18], 8
jb 0x1400a9bad
mov rcx, qword [rbx]
jmp 0x1400a9bb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rbx, 0x20
cmp rbx, qword [rsi + 8]
jne 0x1400a9aa3
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400a9bff
mov rdx, qword [rsi + 8]
call fcn.1400568e0
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
sub r8, rdx
sar r8, 5
call fcn.140056760
mov qword [rsi], 0
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], 0
mov eax, ebp
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14012a2b0
add rsp, 0x470
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400aab20
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
jne 0x1400aab4a
xor eax, eax
jmp 0x1400aac3e
cmp dword [0x14045ebc8], ebx
je 0x1400aabb2
movzx ecx, word [0x14045e53c]
call fcn.140084710
test eax, eax
je 0x1400aab43
mov r9d, 1
lea rax, [rsp + 0x60]
lea rdx, str.PESYSTEMControlSet001_services
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400aaba8
mov rcx, qword [rsp + 0x60]
mov rdx, rdi
call fcn.140060680
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140084820
jmp 0x1400aac3c
xor edx, edx
mov qword [rsp + 0x88], rsi
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, 2
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1400aac26
mov qword [rsp + 0x50], rbx
xor r9d, r9d
mov qword [rsp + 0x48], rbx
or edx, 0xffffffff
mov qword [rsp + 0x40], rbx
mov rcx, rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r8d, [r9 + 3]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x1400aac34
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x88]
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14012a2b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x1400aac60
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov rdi, rcx
mov rbx, qword [rcx]
mov rdx, rax
sub rdx, rbx
sar rdx, 5
test rdx, rdx
je 0x1400aaca7
cmp rbx, rax
je 0x1400aaca7
cmp qword [rbx + 0x18], 8
jb 0x1400aac94
mov rcx, qword [rbx]
jmp 0x1400aac97
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rbx, 0x20
cmp rbx, qword [rdi + 8]
jne 0x1400aac88
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400aacd8
mov rdx, qword [rdi + 8]
call fcn.1400568e0
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
sub r8, rdx
sar r8, 5
call fcn.140056760
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ab3b0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x538], rbx
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rsi, r9
mov rdi, rcx
mov r10d, dword [0x14045e968]
test r10d, r10d
jne 0x1400ab5ee
mov r11, qword [0x1404601d8]
mov rdx, r11
mov r8, qword [0x1404601d0]
sub rdx, r8
movabs rax, 0x1fc07f01fc07f02
imul rdx
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1400ab5ee
mov qword [rbp + 0x180], r8
cmp r8, r11
je 0x1400ab5ee
nop dword [rax]
test r10d, r10d
jne 0x1400ab5ee
lea r9, [r8 + 0x24]
cmp qword [r9 + 0x18], 8
jb 0x1400ab457
mov r9, qword [r9]
mov r8, rdi
lea rdx, [0x140339a20]
lea rcx, [rbp + 0x188]
call fcn.14004bec0
nop
lea rcx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 8
cmovae rcx, qword [rbp + 0x188]
lea rdx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400ab5a1
nop
cmp dword [0x14045e968], 0
jne 0x1400ab597
mov rdx, qword [rbp + 0x180]
add rdx, 0x24
cmp qword [rdx + 0x18], 8
jb 0x1400ab4c2
mov rdx, qword [rdx]
xor r8d, r8d
lea rcx, [rbp + 0x1dc]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400ab57f
lea rcx, [rsp + 0x30]
lea rax, [rbp + 0x1b0]
mov edx, 4
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400ab4f0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov r9, rsi
lea r8, [rbp + 0x180]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400ab280
lea rdx, [rbp + 0x1b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400ab4a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov r8, qword [rbp + 0x1a0]
cmp r8, 8
jb 0x1400ab5c4
inc r8
mov rdx, qword [rbp + 0x188]
lea rcx, [rbp + 0x188]
call fcn.14004e2e0
mov r8, qword [rbp + 0x180]
add r8, 0x81
mov qword [rbp + 0x180], r8
cmp r8, qword [0x1404601d8]
je 0x1400ab5ee
mov r10d, dword [0x14045e968]
jmp 0x1400ab440
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.14012a2b0
mov rbx, qword [rsp + 0x538]
add rsp, 0x510
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ace90
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
lea rax, [rsp + 0x50]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
mov qword [rsp + 0x50], rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 2]
lea r8d, [rdi + 4]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, 2
jne 0x1400acf52
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400acf95
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000002
lea r9d, [rdi + 2]
mov qword [rsp + 0x20], rax
lea r8d, [rdi + 4]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x1400acf97
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400acf95
lea rax, str.d:pagefile.sys_0_0
mov dword [rsp + 0x28], 0x54
lea r9d, [rbx + 7]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.PagingFiles
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14012a2b0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1400ad5f0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov rdi, rcx
xor r14d, r14d
mov qword [rbp + 0x2f], r14
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], r14
test rcx, rcx
je 0x1400ad806
test rdx, rdx
je 0x1400ad806
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400ad806
lea edx, [r14 + 1]
lea r8d, [r14 + 3]
mov rcx, rdi
call fcn.1400526c0
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400ad6a6
lea rax, [rbp + 0x2f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
lea r9, str..pnf
mov r8, rdi
lea rdx, [0x1400ad4f0]
mov rcx, rsi
call fcn.140052e80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x1f]
mov rax, rdx
mov rcx, qword [rbp + 0x17]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x1400ad7f4
cmp qword [rbp + 0x2f], 0
jbe 0x1400ad7f4
call fcn.140083550
mov rsi, rax
mov qword [rax + 0x64], r14
mov dword [rax + 0x6d], r14d
mov byte [rax + 0x6c], 0
cmp word [rbx], 0
jne 0x1400ad6eb
mov r8, r14
jmp 0x1400ad6fb
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400ad6f0
lea rcx, [rax + 0x44]
mov rdx, rbx
call fcn.14004dd70
mov rax, qword [rbp + 0x2f]
mov qword [rsi + 0x64], rax
mov rbx, qword [rbp + 0x17]
cmp rbx, qword [rbp + 0x1f]
je 0x1400ad7e4
nop dword [rax]
cmp dword [0x14045e968], 0
jne 0x1400ad7e4
mov ecx, 0x478
call fcn.14012a618
mov rdi, rax
xor edx, edx
mov r8d, 0x478
mov rcx, rax
call fcn.14027b2c0
cmp qword [rbx + 0x18], 8
jb 0x1400ad756
mov rdx, qword [rbx]
jmp 0x1400ad759
mov rdx, rbx
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], r14
mov word [rbp - 0x29], r14w
cmp word [rdx], 0
jne 0x1400ad775
mov r8, r14
jmp 0x1400ad78b
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400ad780
lea rcx, [rbp - 0x29]
call fcn.14004dd70
mov qword [rbp - 9], rdi
lea rdx, [rbp - 0x29]
lea rcx, [rsi + 0x71]
call fcn.140056980
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 7]
lea rcx, [rsi + 0x71]
call fcn.140056a00
nop
mov r8, qword [rbp - 0x11]
cmp r8, 8
jb 0x1400ad7d6
inc r8
mov rdx, qword [rbp - 0x29]
lea rcx, [rbp - 0x29]
call fcn.14004e2e0
add rbx, 0x20
cmp rbx, qword [rbp + 0x1f]
jne 0x1400ad720
mov rcx, rsi
call fcn.140083090
mov rdx, qword [rbp + 0x1f]
mov rcx, qword [rbp + 0x17]
call fcn.1400568e0
mov rcx, qword [rbp + 0x17]
mov rdx, rcx
mov qword [rbp + 0x1f], rcx
jmp 0x1400ad80e
mov rdx, qword [rbp + 0x1f]
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x1400ad82c
call fcn.1400568e0
mov r8, qword [rbp + 0x27]
mov rdx, qword [rbp + 0x17]
sub r8, rdx
sar r8, 5
call fcn.140056760
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14012a2b0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400ad850
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400ad8de
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400ad8de
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x1400ad8de
movzx eax, word [0x14045e53c]
cmp word [rbx], ax
je 0x1400ad8a2
mov r8d, 1
lea rdx, str._USERPROFILE__:Users_
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400ad8de
test rdi, rdi
jne 0x1400ad8bc
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14004dad0
mov rcx, rax
call fcn.140082440
mov r8, rdi
lea rdx, [0x140082180]
mov rcx, rbx
call fcn.140052c30
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret