joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e8c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44e96f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005247e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x456760
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005245e8], 0
je 0x45676e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x456780
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005245e8], 0
je 0x456795
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x4567a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005245e8], 0
je 0x4567d5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00524b20]
aesenc xmm0, xmmword [0x00524b30]
aesenc xmm0, xmmword [0x00524b40]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x4567e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005245e8], 0
je 0x456816
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00524b20]
aesenc xmm0, xmmword [0x00524b30]
aesenc xmm0, xmmword [0x00524b40]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x4580c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x4584c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4584f4
mov rcx, 0x28
jmp 0x4584ff
shl rcx, 3
add rcx, 0x1480
mov qword [0x005247e0], rcx
pop rbp
ret
Function at 0x140003d54
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
not r8d
mov r9d, 4
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x140076220]
xor r8d, dword [rax + rdx*4]
sub r9, 1
jne 0x140003d5d
not r8d
mov eax, r8d
ret

Function at 0x140003d88
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x140003de2
mov r11b, 0x23
lea rdi, [0x140076220]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x140003dcc
cmp rdx, 2
jb 0x140003dcc
cmp byte [r10], r11b
jne 0x140003dcc
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x140003daa
jmp 0x140003e23
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x140003e23
mov r11b, 0x23
lea rdi, [0x140076220]
cmp dl, r11b
jne 0x140003e07
cmp byte [r10], r11b
jne 0x140003e07
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x140003df5
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x140003f54
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x140003f74
and qword [r8], 0
call fcn.140003e34
mov rbx, rax
test rax, rax
je 0x140004054
mov rcx, rax
call fcn.14003c408
mov ebp, eax
cmp eax, 0xffffffff
je 0x14000404c
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.14003d22c
test eax, eax
jne 0x14000404c
mov rcx, rbx
call fcn.14003c408
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000404c
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.14003d22c
test eax, eax
jne 0x14000404c
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x14000404c
mov rax, qword [0x140088d80]
test rax, rax
je 0x140003fee
inc dword [rax + 0x3b4]
mov rcx, rbp
call fcn.14003b954
mov rdi, rax
test rax, rax
je 0x14000404c
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call fcn.140042454
mov rcx, rbx
cmp rax, rbp
je 0x14000403a
call fcn.14003cc40
mov rax, qword [0x140088d80]
test rax, rax
je 0x140004030
dec dword [rax + 0x3b4]
mov rcx, rdi
call fcn.14003b940
jmp 0x140004054
call fcn.14003cc40
test rsi, rsi
je 0x140004047
mov qword [rsi], rbp
mov rax, rdi
jmp 0x140004056
mov rcx, rbx
call fcn.14003cc40
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002d33c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14002d36a
xor eax, eax
jmp 0x14002d450
cmp qword [rcx + 0x68], 0
je 0x14002d37b
call fcn.14002dc7c
jmp 0x14002d450
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14002d392
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002d394
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002d3c6
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140062d10
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14002d44a
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14002d3fd
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14002d426
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140042454
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14002d44a
cmp rsi, rbx
ja 0x14002d404
test rsi, rsi
je 0x14002d44a
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140042454
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140030810
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
lea rbp, [0x140088dd0]
mov qword [rsp + 0x30], rbp
xor ebx, ebx
mov qword [0x1400891d0], rbx
mov qword [0x1400891d8], rbx
lea ecx, [rbx + 0x48]
call fcn.140034f64
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1400891d0], rax
mov qword [0x1400891e0], rbx
lea rax, [0x14007de08]
mov qword [0x1400891e8], rax
mov qword [0x1400891f0], 0xf4241
mov qword [0x1400891f8], rbx
mov dword [0x140089200], 1
mov dword [0x140089204], 1
lea rax, str._Data
mov qword [0x140089208], rax
mov qword [0x140089210], 1
mov qword [0x140089218], rbx
xorps xmm0, xmm0
movdqa xmmword [0x140089220], xmm0
mov qword [0x140089230], rbx
mov dword [0x140089238], 1
mov qword [0x140089240], rbx
movups xmmword [0x140089248], xmm0
lea r8d, [rbx + 6]
mov qword [0x140089258], r8
lea edi, [rbx + 0xf]
mov qword [0x140089260], rdi
lea rdx, str.010001
lea rcx, [0x140089248]
call fcn.140062d10
mov byte [0x14008924e], bl
xorps xmm0, xmm0
movups xmmword [0x140089268], xmm0
mov qword [0x140089278], rbx
mov qword [0x140089280], rdi
xor r8d, r8d
lea rdx, [0x14007485f]
lea rcx, [0x140089268]
call fcn.140062d10
mov byte [0x140089268], bl
xorps xmm0, xmm0
movups xmmword [0x140089288], xmm0
mov qword [0x140089298], rbx
mov qword [0x1400892a0], rdi
mov byte [0x140089288], bl
mov dword [0x1400892a8], 1
mov r8, rbp
mov edx, ebx
mov r9d, 8
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0xedb88320
mov eax, edx
shr eax, 1
mov edx, ecx
xor edx, eax
sub r9, 1
jne 0x140030975
mov dword [r8], edx
inc ebx
add r8, 4
cmp ebx, 0x100
jl 0x14003096d
mov rax, rbp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140035a9c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140065348]
test rax, rax
je 0x140035ae6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140035ae6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140035ae6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140035ae6
cmp dword [rcx + 0x84], 0xe
jbe 0x140035ae6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140035ae8
xor al, al
add rsp, 0x28
ret
Function at 0x14004bc40
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14004baab
xor ecx, ecx
call qword [0x140065348]
test rax, rax
je 0x14004baab
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004baab
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004baab
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004baab
cmp dword [rcx + 0x84], 0xe
jbe 0x14004baab
cmp dword [rcx + 0xf8], 0
je 0x14004baab
mov ecx, ebx
call fcn.14004bb5c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14004b938
nop
cmp dword [rbp + 0x20], 0
je 0x14004baf9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14004bb04
int3
xor r8d, r8d
xor edx, edx
jmp 0x14004ba3c

Function at 0x140062580
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400625a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400625a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140057b50
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xe0
lea rax, [rsp + 0x50]
lea rcx, [rsp + 0xa0]
mov edx, 0x2d479610
mov r8d, edx
mov qword [rsp + 0xd0], 0x48dfb8d0
mov r9, qword [rsp + 0xd8]
mov qword [rsp + 0x38], rcx
mov rcx, r8
mov r8, r9
shr r8, cl
mov qword [rsp + 0xd8], r8
mov qword [rsp + 0x98], 0x3a83d845
mov r8, r9
sub r8, 0x3f2903fb
mov qword [rsp + 0xd8], r8
mov edx, dword [rsp + 0xcc]
mov dword [rsp + 0xcc], 0x7b321b37
mov r8, r9
xor r8, 0xffffffffffffffff
mov r10, qword [rsp + 0x98]
mov qword [rsp + 0xd8], r8
mov dword [rsp + 0xcc], edx
mov dword [rsp + 0xcc], edx
cmp r10, 0x45800715
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rax
jb 0x140057cf4
jmp 0x140057d39
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xd0]
xor rcx, 0x42c063bf
mov qword [rsp + 0x48], rax
mov edx, dword [rsp + 0x34]
mov dword [rsp + 0xcc], edx
mov rax, qword [rsp + 0x28]
xor rax, 0x4dc03e70
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x28]
xor rax, 0x51937aa2
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd0]
mov r9d, 0xafa99346
mov r10d, r9d
sub r10, rax
mov dword [rsp + 0xcc], 0x1f037393
mov rax, qword [rsp + 0x48]
mov r11b, byte [rsp + r8 + 0xa0]
movsx r9d, r11b
mov si, r9w
mov word [rsp + rax*2 + 0x50], si
mov rax, qword [rsp + 0x98]
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0xd8], r8
add rax, 0x62d6cf50
mov dword [rsp + 0xcc], edx
mov qword [rsp + 0x40], rcx
cmp rax, r10
jb 0x140057c0c
mov eax, 0x3fd1e2ba
mov ecx, eax
mov rdx, qword [rsp + 0x48]
add rdx, 1
mov qword [rsp + 0x40], rdx
mov r8, qword [rsp + 0x28]
shl r8, cl
mov qword [rsp + 0xd8], r8
cmp rdx, 0x20
je 0x140057d39
jmp 0x140057c0c
lea rdx, [0x14007fb40]
mov r8d, 0xb
mov rcx, qword [rsp + 0x38]
call fcn.140059600
mov qword [rsp + 0xd8], 0xffffffffc34d9801
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x28]
imul rdx, rcx, 0x2b4474b8
mov qword [rsp + 0xd8], rdx
jmp 0x140057c0c
mov dword [rsp + 0xcc], 0xf64d231e
lea rcx, [rsp + 0x50]
call fcn.1400597d0
mov dword [rsp + 0xcc], 0x326f59f3
mov rcx, qword [rsp + 0x28]
add rcx, 0x41bc6c78
mov qword [rsp + 0xd8], rcx
add rsp, 0xe0
pop rsi
ret
Function at 0x140059380
Capabilities:
Parse pe header

Disassembly:
push rsi
sub rsp, 0x58
lea rax, [fcn.140059380]
mov ecx, 0x92d9cd53
mov edx, 0x70857f31
mov r8d, 0x5c5c73ba
mov r9d, r8d
mov r8d, dword [rsp + 0x4c]
mov dword [rsp + 0x48], 0x3b4752f8
mov r10, qword [rsp + 0x50]
mov dword [rsp + 0x20], ecx
mov rcx, r9
mov r9, r10
shr r9, cl
mov qword [rsp + 0x50], r9
mov ecx, edx
mov edx, r8d
shl edx, cl
mov r11d, dword [rsp + 0x48]
mov dword [rsp + 0x4c], edx
mov ecx, r8d
mov edx, r8d
shl edx, cl
mov esi, dword [rsp + 0x20]
sub esi, r11d
mov dword [rsp + 0x4c], edx
mov dword [rsp + 0x24], esi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x18], r10
mov dword [rsp + 0x14], r8d
jmp 0x14005950e
mov rax, qword [rsp + 0x28]
mov dword [rsp + 0x4c], 0x509a5a7f
add rax, 0xfffffffffffff000
and rax, 0xfffffffffffff000
mov qword [rsp + 0x30], rax
jmp 0x14005950e
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rsp + 0x14]
mov qword [rsp + 8], rcx
mov ecx, edx
shr edx, cl
mov dword [rsp + 0x4c], edx
mov r8, qword [rsp + 0x18]
add r8, 0x38749958
mov r9, qword [rsp + 8]
mov edx, dword [r9 + rax]
mov qword [rsp + 0x50], r8
mov r10d, dword [rsp + 0x14]
sub r10d, r10d
mov dword [rsp + 0x4c], r10d
cmp edx, 0x4550
je 0x140059503
jmp 0x1400594de
mov eax, 0x3b01e074
mov ecx, 0xa4c41c40
mov edx, dword [rsp + 0x14]
and edx, 0x666a2178
mov r8, qword [rsp + 0x28]
add r8, 0x3c
mov r9d, dword [rsp + 0x48]
mov dword [rsp + 0x4c], edx
sub ecx, r9d
mov qword [rsp + 0x40], r8
mov dword [rsp + 0x4c], 0x6386721
mov edx, dword [rsp + 0x24]
mov r9d, dword [rsp + 0x14]
mov dword [rsp + 4], ecx
mov ecx, r9d
shl eax, cl
mov dword [rsp + 0x4c], eax
mov r8, qword [rsp + 0x18]
or r8, 0x68cebedc
mov qword [rsp + 0x50], r8
mov eax, dword [rsp + 4]
cmp eax, edx
jbe 0x140059540
jmp 0x140059421
mov eax, dword [rsp + 0x14]
imul ecx, eax, 0x4669bfe6
mov edx, dword [rsp + 0x24]
mov dword [rsp + 0x4c], ecx
xor edx, 0x6f2e177e
cmp edx, 0x55fc006f
ja 0x140059540
jmp 0x1400593fe
mov rax, qword [rsp + 0x28]
add rsp, 0x58
pop rsi
ret
mov eax, 0x6d462b01
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x28]
mov edx, dword [rsp + 0x24]
mov qword [rsp + 0x38], rcx
mov r8d, dword [rsp + 0x14]
xor r8d, 0x183a5db1
mov dword [rsp + 0x4c], r8d
cmp eax, edx
jbe 0x1400594de
mov rax, qword [rsp + 0x38]
cmp word [rax], 0x5a4d
je 0x140059474
jmp 0x1400594de
Function at 0x140004930
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x538
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0x528], rax
mov dword [rsp + 0x500], 0
mov dword [rsp + 0x50], 0
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
xor edx, edx
lea rcx, [rsp + 0x468]
call fcn.1400a87c0
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x480]
call fcn.1400a87c0
mov dword [rsp + 0x480], 0x68
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rdx, qword [rsp + 0x540]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0x558], 0
je 0x140004aab
cmp qword [rsp + 0x548], 0
je 0x1400049f1
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x508], rax
jmp 0x140004a2c
lea rcx, [rsp + 0x4f0]
call fcn.140001000
mov qword [rsp + 0x510], rax
mov eax, dword [rsp + 0x500]
or eax, 1
mov dword [rsp + 0x500], eax
mov rcx, qword [rsp + 0x510]
call fcn.14000f8f0
mov qword [rsp + 0x508], rax
lea rax, [rsp + 0x468]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x480]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x500]
and eax, 1
test eax, eax
je 0x140004aa6
and dword [rsp + 0x500], 0xfffffffe
lea rcx, [rsp + 0x4f0]
call fcn.140001490
jmp 0x140004b7d
cmp qword [rsp + 0x548], 0
je 0x140004ac8
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x518], rax
jmp 0x140004b03
lea rcx, [rsp + 0x4f8]
call fcn.140001000
mov qword [rsp + 0x520], rax
mov eax, dword [rsp + 0x500]
or eax, 2
mov dword [rsp + 0x500], eax
mov rcx, qword [rsp + 0x520]
call fcn.14000f8f0
mov qword [rsp + 0x518], rax
lea rax, [rsp + 0x468]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x480]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x518]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x500]
and eax, 2
test eax, eax
je 0x140004b7d
and dword [rsp + 0x500], 0xfffffffd
lea rcx, [rsp + 0x4f8]
call fcn.140001490
mov dword [rsp + 0x460], 0
cmp dword [rsp + 0x550], 0
je 0x140004ba5
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x468]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x50], 0
je 0x140004bcf
mov eax, 1
jmp 0x140004bd1
xor eax, eax
mov rcx, qword [rsp + 0x528]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0x538
ret
Function at 0x140004bf0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.140002100
nop
mov r8d, 1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.140006a60
mov qword [rsp + 0x98], rax
lea rdx, [0x140255bac]
mov rcx, qword [rsp + 0x98]
call fcn.140006d50
mov byte [rsp + 0x60], al
lea rcx, [rsp + 0x68]
call fcn.140001490
movzx r11d, byte [rsp + 0x60]
test r11d, r11d
je 0x140004cba
lea rcx, [rsp + 0x50]
call fcn.140001a40
mov r8d, eax
sub r8d, 1
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140006b20
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x50]
call fcn.140002db0
nop
lea rcx, [rsp + 0x70]
call fcn.140001490
lea rcx, [rsp + 0x20]
call fcn.1400767b0
nop
lea rcx, [rsp + 0x50]
call fcn.14000f8f0
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400768b4
mov dword [rsp + 0x5c], eax
lea rcx, [rsp + 0x20]
call fcn.1400763e8
cmp dword [rsp + 0x5c], 0
je 0x140004d1a
mov dword [rsp + 0x78], 1
lea rcx, [rsp + 0x20]
call fcn.14007680c
nop
lea rcx, [rsp + 0x50]
call fcn.140001490
mov eax, dword [rsp + 0x78]
jmp 0x140004e1a
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x50]
call fcn.1400068a0
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x140004d59
mov dword [rsp + 0x7c], 1
lea rcx, [rsp + 0x20]
call fcn.14007680c
nop
lea rcx, [rsp + 0x50]
call fcn.140001490
mov eax, dword [rsp + 0x7c]
jmp 0x140004e1a
mov r8d, dword [rsp + 0x58]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.140006b20
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x50]
call fcn.140002db0
nop
lea rcx, [rsp + 0x80]
call fcn.140001490
lea rcx, [rsp + 0x50]
call fcn.14000f8f0
mov rcx, rax
call fcn.140004bf0
test eax, eax
je 0x140004df3
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [rsp + 0x88], eax
lea rcx, [rsp + 0x20]
call fcn.14007680c
nop
lea rcx, [rsp + 0x50]
call fcn.140001490
mov eax, dword [rsp + 0x88]
jmp 0x140004e1a
mov dword [rsp + 0x8c], 0
lea rcx, [rsp + 0x20]
call fcn.14007680c
nop
lea rcx, [rsp + 0x50]
call fcn.140001490
mov eax, dword [rsp + 0x8c]
add rsp, 0xc8
ret
Function at 0x140004ff0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x60]
call fcn.140002100
nop
mov r8w, VarDateFromDisp
mov dx, 0x2f
lea rcx, [rsp + 0x60]
call fcn.140006200
lea rcx, [rsp + 0x60]
call fcn.140001a40
mov edx, eax
sub edx, 1
lea rcx, [rsp + 0x60]
call fcn.140006dd0
movzx eax, ax
cmp eax, 0x5c
jne 0x1400050a4
lea rcx, [rsp + 0x60]
call fcn.140001a40
mov r9d, eax
sub r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call fcn.1400022a0
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x60]
call fcn.140002db0
nop
lea rcx, [rsp + 0x68]
call fcn.140001490
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14000e6d0
mov r8d, 0x38
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.1400a87c0
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x60]
call fcn.14000f8f0
mov qword [rsp + 0x38], rax
mov eax, 0x410
mov word [rsp + 0x48], ax
lea rcx, [rsp + 0x28]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140005114
cmp dword [rsp + 0x20], 2
je 0x140005114
cmp dword [rsp + 0x20], 3
je 0x140005114
mov dword [rsp + 0x90], 0
jmp 0x14000511f
mov dword [rsp + 0x90], 1
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x60]
call fcn.140001490
mov eax, dword [rsp + 0x70]
add rsp, 0xa8
ret

Function at 0x1400055b0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor eax, eax
test eax, eax
jne 0x1400055be
xor eax, eax
test eax, eax
jne 0x1400055be
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add rsp, 0x28
ret

Function at 0x1400057b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x1400057c3
xor eax, eax
test eax, eax
jne 0x1400057c3
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x140005817
mov eax, dword [rsp + 0x38]
jmp 0x140005827
cmp dword [rsp + 0x30], 4
je 0x140005825
mov eax, reloc.WSOCK32.dll_listen
jmp 0x140005827
xor eax, eax
add rsp, 0x48
ret