joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140061bb0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x50], 0
jne 0x140061bc3
jmp 0x140061c02
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x140061900]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
je 0x140061c02
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x48
ret

Function at 0x140062db0
Capabilities:
Check internet connectivity via wininet

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov byte [rsp + 0x21], 0
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WININET.dll_InternetCheckConnectionA]
test eax, eax
je 0x140062dea
mov byte [rsp + 0x20], 1
jmp 0x140062def
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
jmp 0x140062dfa
movzx eax, byte [rsp + 0x21]
add rsp, 0x38
ret

Function at 0x140062e10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xd0], 0
jne 0x140062e6a
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x140062e80]
xor edx, edx
xor ecx, ecx
call fcn.140151cb8
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0xd0], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140138320
add rsp, 0x48
ret
Function at 0x140064ce0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 8], 0
je 0x140064d08
xor al, al
jmp 0x140064d4a
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x140064d60]
xor edx, edx
xor ecx, ecx
call fcn.140151cb8
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 8], 0
jne 0x140064d48
xor al, al
jmp 0x140064d4a
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140138320
add rsp, 0x48
ret

Function at 0x140064f30
Capabilities:
Check if file exists
Delete file

Disassembly:
sub rsp, 0x328
mov qword [rsp + 0x138], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x318], rax
lea rcx, [0x1401cf8f0]
jmp 0x1402390ce
Function at 0x140065860
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xd0]
call fcn.1400101f0
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14001b3c0
nop
lea rcx, [rsp + 0x78]
call fcn.140010300
movzx eax, al
test eax, eax
je 0x1400658d4
lea rcx, [rsp + 0x78]
call fcn.140010220
nop
mov rcx, qword [rsp + 0xd0]
call fcn.140010220
jmp 0x140065a94
lea rcx, [rsp + 0x78]
call fcn.1400101f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400659f2
mov r8, 0xffffffffffffffff
mov dx, 0x5c
lea rcx, [rsp + 0x78]
call fcn.140022d80
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffffff
jne 0x14006592c
lea rcx, [rsp + 0x78]
call fcn.140010220
nop
mov rcx, qword [rsp + 0xd0]
call fcn.140010220
jmp 0x140065a94
movsxd rax, dword [rsp + 0x30]
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x78]
call fcn.140022c10
nop
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x50]
call fcn.14001ab50
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.14001b8d0
nop
lea rcx, [rsp + 0x50]
call fcn.140009960
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x78]
call fcn.1400101f0
lea r8, [0x1401cfe3c]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140140ed4
cmp qword [rsp + 0x70], 0
jne 0x1400659da
lea rcx, [rsp + 0x98]
call fcn.140010220
nop
lea rcx, [rsp + 0x78]
call fcn.140010220
nop
mov rcx, qword [rsp + 0xd0]
call fcn.140010220
jmp 0x140065a94
mov rcx, qword [rsp + 0x70]
call fcn.140141014
nop
lea rcx, [rsp + 0x98]
call fcn.140010220
movzx eax, byte [rsp + 0xd8]
test eax, eax
je 0x140065a33
mov rcx, qword [rsp + 0xd0]
call fcn.1400101f0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.taskbarunpin
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140065a66
mov rcx, qword [rsp + 0xd0]
call fcn.1400101f0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.startunpin
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x78]
call fcn.1400101f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rsp + 0x78]
call fcn.140010220
nop
jmp 0x140065a87
mov rcx, qword [rsp + 0xd0]
call fcn.140010220
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140138320
add rsp, 0xc8
ret
Function at 0x1400675b0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2e8
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov edx, 8
lea rcx, [rsp + 0x68]
call fcn.14000c8b0
mov rdx, qword [rsp + 0x2f0]
lea rcx, [rsp + 0x68]
call fcn.140010d70
nop
lea rcx, [rsp + 0x68]
call fcn.140010e90
dec eax
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140037850
movzx eax, ax
cmp eax, 0x5c
je 0x140067625
mov dl, 0x5c
lea rcx, [rsp + 0x68]
call fcn.1400228f0
lea r8, [0x1401d06b8]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14000fed0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140022bc0
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x40]
call fcn.14000ffc0
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x140067699
lea rcx, [rsp + 0x68]
call fcn.14000ffc0
nop
mov rcx, qword [rsp + 0x2f0]
call fcn.14000ffc0
jmp 0x140067821
mov eax, dword [rsp + 0x80]
and eax, 0x10
test eax, eax
je 0x1400676d8
lea rdx, [0x1401b3e24]
lea rcx, [rsp + 0xac]
call fcn.140146e70
test eax, eax
je 0x1400676d3
lea rdx, [0x1401d0700]
lea rcx, [rsp + 0xac]
call fcn.140146e70
jmp 0x1400677e2
mov edx, 8
lea rcx, [rsp + 0x78]
call fcn.14000c8b0
lea r8, [rsp + 0xac]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.14000fed0
nop
mov dx, reloc.WLDAP32.dll_Ordinal_46
lea rcx, [rsp + 0x78]
call fcn.140078b50
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x1400677d8
mov edx, 8
lea rcx, [rsp + 0x70]
call fcn.14000c8b0
lea rcx, [rsp + 0x78]
call fcn.140010e90
sub eax, dword [rsp + 0x20]
dec eax
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140022770
nop
lea rcx, [rsp + 0x70]
call fcn.140078af0
lea rdx, [0x1401d0708]
lea rcx, [rsp + 0x70]
call fcn.140078ab0
movzx eax, al
test eax, eax
jne 0x140067788
lea rdx, [0x1401d06e0]
lea rcx, [rsp + 0x70]
call fcn.140078ab0
movzx eax, al
test eax, eax
je 0x1400677cd
lea r8, [rsp + 0xac]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x58]
call fcn.14000fed0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.140022bc0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rsp + 0x58]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x70]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x78]
call fcn.14000ffc0
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140067699
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x68]
call fcn.14000ffc0
nop
mov rcx, qword [rsp + 0x2f0]
call fcn.14000ffc0
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140138320
add rsp, 0x2e8
ret
Function at 0x140067b60
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x28]
call fcn.14001a240
nop
lea r8, str.Program_FilesOffice2007__
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x68]
call fcn.140025700
nop
lea r8, str.Program_Files__x86_Office2007__
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.140025700
nop
lea rcx, [rsp + 0x68]
call fcn.1400101f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140067bed
lea rcx, [rsp + 0x48]
call fcn.1400101f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140067c88
mov r8b, 1
lea rdx, str..doc
mov rcx, 0xffffffff80000000
call fcn.1400371c0
mov r8b, 1
lea rdx, [0x1401d0dac]
mov rcx, 0xffffffff80000000
call fcn.1400371c0
mov r8b, 1
lea rdx, str..ppt
mov rcx, 0xffffffff80000000
call fcn.1400371c0
mov r8b, 1
lea rdx, str..pptx
mov rcx, 0xffffffff80000000
call fcn.1400371c0
mov r8b, 1
lea rdx, str..xls
mov rcx, 0xffffffff80000000
call fcn.1400371c0
mov r8b, 1
lea rdx, str..xlsx
mov rcx, 0xffffffff80000000
call fcn.1400371c0
mov r8b, 1
lea rdx, str..accdb
mov rcx, 0xffffffff80000000
call fcn.1400371c0
nop
lea rcx, [rsp + 0x48]
call fcn.140010220
nop
lea rcx, [rsp + 0x68]
call fcn.140010220
nop
lea rcx, [rsp + 0x28]
call fcn.140010220
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140138320
add rsp, 0x98
ret
Function at 0x14006b140
Capabilities:
Check if file exists
Copy file
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x958
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x940], rax
lea rcx, [0x1401d1f70]
jmp 0x140239b2d

Function at 0x14006b530
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push rdi
sub rsp, 0x390
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x380], rax
lea rcx, [0x1401d23c0]
jmp 0x14023a16c

Function at 0x14006b8c0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rdi
sub rsp, 0x290
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WLDAP32.dll_Ordinal_26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, 8
lea rcx, [rsp + 0x60]
call fcn.14000c8b0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.14000fff0
nop
mov edx, 8
lea rcx, [rsp + 0x58]
call fcn.14000c8b0
lea r8, str.360safe
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call fcn.14000fed0
nop
lea rcx, [rsp + 0x58]
call fcn.140010050
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14006b9ab
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x58]
call fcn.140010050
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.14000fff0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dl, 1
mov rcx, qword [rsp + 0x40]
call fcn.140036a00
nop
lea rcx, [rsp + 0x58]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x60]
call fcn.14000ffc0
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140138320
add rsp, 0x290
pop rdi
ret

Function at 0x14006c3f0
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x390
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x380], rax
lea rcx, [0x1401d28f8]
jmp 0x14023b499

Function at 0x14006c720
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x390
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x380], rax
lea rcx, [0x1401d2a00]
jmp 0x14023b930

Function at 0x14006ca50
Capabilities:
Check if file exists
Execute anti-debugging instructions
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4c0
mov qword [rsp + 0x110], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
lea rcx, [0x1401d2a18]
jmp 0x14023bdb7
Function at 0x14006d050
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rdi
sub rsp, 0x2d0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WLDAP32.dll_Ordinal_26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, 8
lea rcx, [rsp + 0xa8]
call fcn.14000c8b0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xa8]
call fcn.14000fff0
nop
lea rdx, str.360Game5_bin360Game.exe
lea rcx, [rsp + 0xa8]
call fcn.1400229e0
lea rcx, [rsp + 0xa8]
call fcn.140010050
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14006d184
lea rdx, [0x1401d3330]
lea rcx, [rsp + 0x68]
call fcn.140009a10
nop
lea rcx, [rsp + 0xa8]
call fcn.140010050
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140023080
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x88]
call fcn.14001ab50
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
call fcn.14001db60
nop
lea rcx, [rsp + 0x88]
call fcn.140009960
nop
lea rcx, [rsp + 0x48]
call fcn.140010220
nop
lea rcx, [rsp + 0x68]
call fcn.140009960
nop
lea rcx, [rsp + 0xa8]
call fcn.14000ffc0
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.140138320
add rsp, 0x2d0
pop rdi
ret

Function at 0x14006d340
Capabilities:
Check if file exists
Delete file
Execute anti-debugging instructions
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push rdi
sub rsp, 0xb40
mov qword [rsp + 0x308], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0xb30], rax
lea rcx, [0x1401d3478]
jmp 0x14023c8e7

Function at 0x14006e630
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rdi
sub rsp, 0x330
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x320], rax
lea rcx, [0x1401d38f0]
jmp 0x14023e712

Function at 0x14006e950
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rdi
sub rsp, 0x330
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x320], rax
lea rcx, [0x1401d3900]
jmp 0x14023eb2c

Function at 0x14006ec70
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rdi
sub rsp, 0x330
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x320], rax
lea rcx, [0x1401d3958]
jmp 0x14023ef2e
Function at 0x14006fd20
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 6
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
call fcn.14000fff0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.140036a00
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140138320
add rsp, 0x280
pop rdi
ret

Function at 0x1400701b0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [0x1401d3e78]
jmp 0x14023f390

Function at 0x140070310
Capabilities:
Delete file

Disassembly:
sub rsp, 0x1d8
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea rcx, [0x1401d3dd8]
jmp 0x14023f552

Function at 0x140070bb0
Capabilities:
Check if file exists
Delete file

Disassembly:
sub rsp, 0x158
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [0x1401d4538]
jmp 0x14023f995

Function at 0x1400716e0
Capabilities:
Check if file exists
Copy file
Create directory

Disassembly:
sub rsp, 0x308
mov qword [rsp + 0x120], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
lea rcx, [0x1401d4b48]
jmp 0x1402407d8
Function at 0x140071f70
Capabilities:
Check if file exists
Persist via run registry key

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov edx, 8
lea rcx, [rsp + 0x28]
call fcn.14000c8b0
lea rdx, str.C:Program_FilesHLAppStoreHLAppStore.exe
lea rcx, [rsp + 0x28]
call fcn.14000fff0
nop
lea rcx, [rsp + 0x28]
call fcn.140010050
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140071fd3
lea rcx, [rsp + 0x28]
call fcn.14000ffc0
jmp 0x1400720b3
mov edx, Ordinal_26
lea rcx, [rsp + 0x38]
call fcn.14000c8b0
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140018330
nop
mov edx, 8
lea rcx, [rsp + 0x30]
call fcn.14000c8b0
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea rcx, [rsp + 0x30]
call fcn.14000fff0
nop
lea rcx, [rsp + 0x30]
call fcn.140010050
mov r9d, 0xf003f
mov r8, rax
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x38]
call fcn.140018590
test eax, eax
je 0x14007205a
lea rcx, [rsp + 0x30]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x38]
call fcn.140018370
nop
lea rcx, [rsp + 0x28]
call fcn.14000ffc0
jmp 0x1400720b3
lea rcx, [rsp + 0x28]
call fcn.140010050
mov r9d, 1
mov r8, rax
lea rdx, str.HLAPP
lea rcx, [rsp + 0x38]
call fcn.140018930
lea rcx, [rsp + 0x38]
call fcn.1400183e0
lea rcx, [rsp + 0x38]
call fcn.140018390
nop
lea rcx, [rsp + 0x30]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x38]
call fcn.140018370
nop
lea rcx, [rsp + 0x28]
call fcn.14000ffc0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140138320
add rsp, 0x68
ret
Function at 0x1400720d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x320
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov edx, 8
lea rcx, [rsp + 0xf8]
call fcn.14000c8b0
mov r8, qword [rsp + 0x338]
lea rdx, [0x1401d4fb0]
lea rcx, [rsp + 0x58]
call fcn.140022580
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea r8, str.__modeenable_program_
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0xf8]
call fcn.14000fed0
nop
lea rcx, [rsp + 0x58]
call fcn.14000ffc0
lea rdx, [0x1401b50ac]
lea rcx, [rsp + 0x40]
call fcn.140022af0
nop
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x330]
lea rcx, [rsp + 0x70]
call fcn.140022670
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0xf8]
call fcn.140022a10
nop
lea rcx, [rsp + 0x70]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x40]
call fcn.14000ffc0
lea rax, [rsp + 0x100]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, 8
lea rcx, [rsp + 0xf0]
call fcn.14000c8b0
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xf0]
call fcn.14000fff0
nop
lea rdx, [0x1401d5188]
lea rcx, [rsp + 0xf0]
call fcn.140022950
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0xf8]
call fcn.140010050
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140023080
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0xf0]
call fcn.140010050
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140023080
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
call fcn.1400193e0
nop
lea rcx, [rsp + 0xf0]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0xf8]
call fcn.14000ffc0
nop
mov rcx, qword [rsp + 0x330]
call fcn.14000ffc0
nop
mov rcx, qword [rsp + 0x338]
call fcn.14000ffc0
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.140138320
add rsp, 0x320
pop rdi
ret
Function at 0x140072330
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x320
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov edx, 8
lea rcx, [rsp + 0xf8]
call fcn.14000c8b0
mov r8, qword [rsp + 0x338]
lea rdx, str._c_netsh_firewall_add_allowedprogram_name_
lea rcx, [rsp + 0x58]
call fcn.140022580
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea r8, str.__modeenable_profileall_program_
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0xf8]
call fcn.14000fed0
nop
lea rcx, [rsp + 0x58]
call fcn.14000ffc0
lea rdx, [0x1401b50bc]
lea rcx, [rsp + 0x40]
call fcn.140022af0
nop
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x330]
lea rcx, [rsp + 0x70]
call fcn.140022670
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0xf8]
call fcn.140022a10
nop
lea rcx, [rsp + 0x70]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0x40]
call fcn.14000ffc0
lea rax, [rsp + 0x100]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, 8
lea rcx, [rsp + 0xf0]
call fcn.14000c8b0
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xf0]
call fcn.14000fff0
nop
lea rdx, str.cmd.exe
lea rcx, [rsp + 0xf0]
call fcn.140022950
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0xf8]
call fcn.140010050
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140023080
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0xf0]
call fcn.140010050
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140023080
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
call fcn.1400193e0
nop
lea rcx, [rsp + 0xf0]
call fcn.14000ffc0
nop
lea rcx, [rsp + 0xf8]
call fcn.14000ffc0
nop
mov rcx, qword [rsp + 0x330]
call fcn.14000ffc0
nop
mov rcx, qword [rsp + 0x338]
call fcn.14000ffc0
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.140138320
add rsp, 0x320
pop rdi
ret