joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001520
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftwindows_ntcurrentversion
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400015c3
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x140021820]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400015b8
lea rdx, [rsp + 0x50]
lea rcx, str.iotuap
call fcn.140007808
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140008390
add rsp, 0x270
pop rbx
ret
Function at 0x1400018d0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r14, r8
mov rdi, rdx
mov r12, rcx
mov r15d, ebp
test rdx, rdx
je 0x1400019be
test r8, r8
je 0x1400019be
mov qword [rsp + 0x50], rbx
mov ebx, ebp
mov qword [rsp + 0x60], r13
lea r13d, [rbp + 1]
cmp dword [rdx], ebx
jle 0x14000198d
mov qword [rsp + 0x58], rsi
mov esi, ebp
nop dword [rax + rax]
mov rcx, qword [r14 + rsi*8]
lea rdx, [0x140021788]
call fcn.140007808
test eax, eax
je 0x140001953
mov rcx, qword [r14 + rsi*8]
lea rdx, str._accepteula
call fcn.140007808
test eax, eax
je 0x140001953
inc ebx
inc rsi
cmp ebx, dword [rdi]
jl 0x140001920
jmp 0x140001988
mov eax, dword [rdi]
mov r15d, r13d
dec eax
cmp ebx, eax
jge 0x140001986
lea rdx, [r14 + rsi*8]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdx + 8]
inc ebx
lea rdx, [rdx + 8]
mov qword [rdx - 8], rax
mov eax, dword [rdi]
dec eax
cmp ebx, eax
jl 0x140001970
dec dword [rdi]
mov rsi, qword [rsp + 0x58]
mov edx, r15d
mov rcx, r12
call fcn.140001aa0
mov rbx, qword [rsp + 0x50]
test eax, eax
cmovne r15d, r13d
mov r13, qword [rsp + 0x60]
test r15d, r15d
setne bpl
mov eax, ebp
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor r8d, r8d
xor edx, edx
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
jmp 0x140001ed0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r14, r8
mov rdi, rdx
mov r12, rcx
lea r13d, [rbp + 1]
mov r15d, ebp
test rdx, rdx
je 0x140001f03
test r8, r8
jne 0x140001f44
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x140021758]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001fcd
lea rdi, [0x14002f9e0]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rdi
mov rcx, rax
call rbx
mov r14, rax
mov ebx, ebp
cmp dword [rdi], ebx
jle 0x140001fcd
mov qword [rsp + 0x50], rsi
mov rsi, rbp
nop word [rax + rax]
mov rcx, qword [r14 + rsi*8]
lea rdx, [0x140021788]
call fcn.140007808
test eax, eax
je 0x140001f93
mov rcx, qword [r14 + rsi*8]
lea rdx, str._accepteula
call fcn.140007808
test eax, eax
je 0x140001f93
inc ebx
inc rsi
cmp ebx, dword [rdi]
jl 0x140001f60
jmp 0x140001fc8
mov eax, dword [rdi]
mov r15d, r13d
dec eax
cmp ebx, eax
jge 0x140001fc6
lea rdx, [r14 + rsi*8]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdx + 8]
inc ebx
lea rdx, [rdx + 8]
mov qword [rdx - 8], rax
mov eax, dword [rdi]
dec eax
cmp ebx, eax
jl 0x140001fb0
dec dword [rdi]
mov rsi, qword [rsp + 0x50]
mov edx, r15d
mov rcx, r12
call fcn.140001aa0
mov rbx, qword [rsp + 0x58]
test eax, eax
cmovne r15d, r13d
test r15d, r15d
setne bpl
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001ed0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r14, r8
mov rdi, rdx
mov r12, rcx
mov r15d, ebp
test rdx, rdx
je 0x1400019be
test r8, r8
je 0x1400019be
mov qword [rsp + 0x50], rbx
mov ebx, ebp
mov qword [rsp + 0x60], r13
lea r13d, [rbp + 1]
cmp dword [rdx], ebx
jle 0x14000198d
mov qword [rsp + 0x58], rsi
mov esi, ebp
nop dword [rax + rax]
mov rcx, qword [r14 + rsi*8]
lea rdx, [0x140021788]
call fcn.140007808
test eax, eax
je 0x140001953
mov rcx, qword [r14 + rsi*8]
lea rdx, str._accepteula
call fcn.140007808
test eax, eax
je 0x140001953
inc ebx
inc rsi
cmp ebx, dword [rdi]
jl 0x140001920
jmp 0x140001988
mov eax, dword [rdi]
mov r15d, r13d
dec eax
cmp ebx, eax
jge 0x140001986
lea rdx, [r14 + rsi*8]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdx + 8]
inc ebx
lea rdx, [rdx + 8]
mov qword [rdx - 8], rax
mov eax, dword [rdi]
dec eax
cmp ebx, eax
jl 0x140001970
dec dword [rdi]
mov rsi, qword [rsp + 0x58]
mov edx, r15d
mov rcx, r12
call fcn.140001aa0
mov rbx, qword [rsp + 0x50]
test eax, eax
cmovne r15d, r13d
mov r13, qword [rsp + 0x60]
test r15d, r15d
setne bpl
mov eax, ebp
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor r8d, r8d
xor edx, edx
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
jmp 0x140001ed0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r14, r8
mov rdi, rdx
mov r12, rcx
lea r13d, [rbp + 1]
mov r15d, ebp
test rdx, rdx
je 0x140001f03
test r8, r8
jne 0x140001f44
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x140021758]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001fcd
lea rdi, [0x14002f9e0]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rdi
mov rcx, rax
call rbx
mov r14, rax
mov ebx, ebp
cmp dword [rdi], ebx
jle 0x140001fcd
mov qword [rsp + 0x50], rsi
mov rsi, rbp
nop word [rax + rax]
mov rcx, qword [r14 + rsi*8]
lea rdx, [0x140021788]
call fcn.140007808
test eax, eax
je 0x140001f93
mov rcx, qword [r14 + rsi*8]
lea rdx, str._accepteula
call fcn.140007808
test eax, eax
je 0x140001f93
inc ebx
inc rsi
cmp ebx, dword [rdi]
jl 0x140001f60
jmp 0x140001fc8
mov eax, dword [rdi]
mov r15d, r13d
dec eax
cmp ebx, eax
jge 0x140001fc6
lea rdx, [r14 + rsi*8]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdx + 8]
inc ebx
lea rdx, [rdx + 8]
mov qword [rdx - 8], rax
mov eax, dword [rdi]
dec eax
cmp ebx, eax
jl 0x140001fb0
dec dword [rdi]
mov rsi, qword [rsp + 0x50]
mov edx, r15d
mov rcx, r12
call fcn.140001aa0
mov rbx, qword [rsp + 0x58]
test eax, eax
cmovne r15d, r13d
test r15d, r15d
setne bpl
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002230
Capabilities:
Get file version info

Disassembly:
test ecx, ecx
jne 0x1400023b7
mov r11, rsp
sub rsp, 0x278
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
lea rdx, [rsp + 0x50]
mov r8d, 0x208
xor ecx, ecx
mov qword [r11 - 8], r14
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ecx, eax
mov ebx, eax
call fcn.140007da8
lea rcx, [rsp + 0x50]
mov r8d, ebx
mov r9, rax
xor edx, edx
mov rdi, rax
call sub.VERSION.dll_GetFileVersionInfoW
lea rdx, [0x140021a68]
mov rcx, rdi
call fcn.140002450
lea rdx, [0x140021a88]
mov rcx, rdi
mov rbx, rax
call fcn.140002450
lea rdx, [0x140021aa0]
mov rcx, rdi
mov rsi, rax
call fcn.140002450
lea rdx, [0x140021ac0]
mov rcx, rdi
mov rbp, rax
call fcn.140002450
lea rdx, [0x140021ae0]
mov rcx, rdi
mov r14, rax
call fcn.140002450
mov rdi, rax
call fcn.1400015e0
test eax, eax
je 0x140002340
call fcn.140008c34
mov qword [rsp + 0x30], rdi
lea rdx, str._n_s_v_s____s_n_s_n_s_n_n
lea rcx, [rax + 0x30]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
call fcn.140009050
call fcn.140008c34
lea rcx, [rax + 0x30]
jmp 0x140002373
call fcn.140008c34
mov qword [rsp + 0x30], rdi
lea rdx, str._n_s_v_s____s_n_s_n_s_n_n
lea rcx, [rax + 0x60]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
call fcn.140009050
call fcn.140008c34
lea rcx, [rax + 0x60]
call fcn.140008e1c
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x280]
mov r14, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140008390
add rsp, 0x278
ret
Function at 0x140002238
Capabilities:
Get file version info

Disassembly:
test ecx, ecx
jne 0x1400023b7
mov r11, rsp
sub rsp, 0x278
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
lea rdx, [rsp + 0x50]
mov r8d, 0x208
xor ecx, ecx
mov qword [r11 - 8], r14
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ecx, eax
mov ebx, eax
call fcn.140007da8
lea rcx, [rsp + 0x50]
mov r8d, ebx
mov r9, rax
xor edx, edx
mov rdi, rax
call sub.VERSION.dll_GetFileVersionInfoW
lea rdx, [0x140021a68]
mov rcx, rdi
call fcn.140002450
lea rdx, [0x140021a88]
mov rcx, rdi
mov rbx, rax
call fcn.140002450
lea rdx, [0x140021aa0]
mov rcx, rdi
mov rsi, rax
call fcn.140002450
lea rdx, [0x140021ac0]
mov rcx, rdi
mov rbp, rax
call fcn.140002450
lea rdx, [0x140021ae0]
mov rcx, rdi
mov r14, rax
call fcn.140002450
mov rdi, rax
call fcn.1400015e0
test eax, eax
je 0x140002340
call fcn.140008c34
mov qword [rsp + 0x30], rdi
lea rdx, str._n_s_v_s____s_n_s_n_s_n_n
lea rcx, [rax + 0x30]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
call fcn.140009050
call fcn.140008c34
lea rcx, [rax + 0x30]
jmp 0x140002373
call fcn.140008c34
mov qword [rsp + 0x30], rdi
lea rdx, str._n_s_v_s____s_n_s_n_s_n_n
lea rcx, [rax + 0x60]
mov r9, rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbp
call fcn.140009050
call fcn.140008c34
lea rcx, [rax + 0x60]
call fcn.140008e1c
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x280]
mov r14, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140008390
add rsp, 0x278
ret
Function at 0x140002960
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rbp, rdx
mov rdx, rcx
lea r8, [0x140021bb8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x140002992
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rdi
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rdx, [0x140021bc8]
mov rcx, rbp
mov rsi, rax
call fcn.140009e20
mov rbx, rax
test rax, rax
je 0x1400029f7
mov r8, rdi
mov r9, rax
mov edx, 1
mov rcx, rsi
call fcn.140009be0
mov rcx, rbx
call fcn.1400098c0
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140002b40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
lea r8, [rsp + 0x58]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140002bca
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea rdx, str.NanoServer
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002bbf
cmp dword [rsp + 0x40], 4
jne 0x140002bbf
mov eax, 1
cmp dword [rsp + 0x48], eax
cmove ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140002be0
Capabilities:
Create service

Disassembly:
push rbp
push rsi
push r12
push r15
sub rsp, 0x78
mov rbp, r8
mov r12, rdx
xor edx, edx
mov r8d, 0xf003f
mov r15, r9
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140002c15
add rsp, 0x78
pop r15
pop r12
pop rsi
pop rbp
ret
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0x70], r14
movzx r14d, byte [rsp + 0xc0]
xor edi, edi
mov r13d, 0x110
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r15
mov eax, 0x10
mov dword [rsp + 0x30], edi
test r14b, r14b
cmovne eax, r13d
mov r9d, 0xf01ff
mov r8, r12
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x140002cd6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
cmp eax, 0x431
sete cl
test ecx, ecx
jne 0x140002cdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x34
je 0x140002cdf
cmp eax, 0x431
je 0x140002cdf
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140002d0e
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, rbp
mov rcx, rsi
call fcn.140003b60
test al, al
jne 0x140002d0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x20
je 0x140002c50
cmp eax, 0x3e5
je 0x140002c50
jmp 0x140002d0e
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsp + 0x70]
mov r13, qword [rsp + 0xb0]
test ebx, ebx
mov rbx, qword [rsp + 0xa0]
sete dil
mov eax, edi
mov rdi, qword [rsp + 0xa8]
add rsp, 0x78
pop r15
pop r12
pop rsi
pop rbp
ret
Function at 0x140002d50
Capabilities:
Impersonate user

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov rax, qword [0x14002e260]
xor rax, rbp
mov qword [rbp + 8], rax
xor r15d, r15d
mov r14, r9
mov rsi, r8
mov rdi, rcx
mov qword [rbp], r15
test rdx, rdx
je 0x140002e8d
test r8, r8
je 0x140002e8d
or rax, 0xffffffffffffffff
nop
cmp word [rdx + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x140002da0
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140002dc7
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14000a270
sub rsp, rcx
lea rbx, [rsp + 0x30]
mov rcx, rbx
sub rcx, rdx
movzx eax, word [rdx]
lea rdx, [rdx + 2]
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x140002de1
mov edx, 0x5c
mov rcx, rbx
call fcn.140009708
test rax, rax
je 0x140002e11
mov word [rax], r15w
add rax, 2
mov rdx, rbx
jmp 0x140002e1b
lea rdx, [0x140021fd8]
mov rax, rbx
lea rcx, [rbp]
mov r9d, 9
mov r8, rsi
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
test al, al
jne 0x140002e6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140008c34
lea rdx, str.Cannot_log_on_to__s:_n
mov r8, rdi
lea rcx, [rax + 0x60]
call fcn.140008fbc
mov ecx, ebx
call fcn.140003030
jmp 0x140002ed8
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test al, al
jne 0x140002e8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002e4a
mov r8, qword [rbp + 0x50]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov ebx, eax
test eax, eax
je 0x140002ec2
call fcn.140008c34
lea rdx, str.Cannot_connect_to_remote_registry_on__s:_n
mov r8, rdi
lea rcx, [rax + 0x60]
call fcn.140008fbc
mov ecx, ebx
call fcn.140003030
cmp qword [rbp], r15
je 0x140002ed8
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.140008390
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop rbp
ret
Function at 0x140002f00
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbp, rdx
mov rsi, rcx
lea rdx, [rsp + 0x40]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x40]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ecx, eax
mov ebx, eax
call fcn.140007da8
lea rcx, [rsp + 0x40]
mov r8d, ebx
mov r9, rax
xor edx, edx
mov rdi, rax
call sub.VERSION.dll_GetFileVersionInfoW
mov eax, 0x400
lea r9, [rsp + 0x30]
mov word [rsp + 0x20], ax
lea rax, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, str.VarFileInfoTranslation
mov rcx, rdi
mov qword [rsp + 0x28], rax
call sub.VERSION.dll_VerQueryValueW
mov rax, qword [rsp + 0x28]
lea r9, [0x140021a68]
movzx r8d, word [rax + 2]
movzx edx, word [rax]
mov rcx, rdi
call fcn.140002a10
mov r8, rbp
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1400020c0
test rsi, rsi
je 0x140002fd8
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.1400018d0
test eax, eax
je 0x140003003
mov rcx, rdi
call fcn.140007d68
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140008390
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
call fcn.140008c34
lea rdx, [0x140022120]
lea rcx, [rax + 0x60]
call fcn.140009928
mov ecx, 1
call fcn.140007d5c
int3

Function at 0x140003030
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
lea eax, [rcx - 0x834]
xor ebx, ebx
mov esi, ecx
mov edi, 0x1300
cmp eax, 0x383
ja 0x140003076
lea r8d, [rbx + 2]
lea rcx, str.netmsg.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
mov eax, 0x1b00
test rbx, rbx
cmovne edi, eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], 0
mov r9d, 0x400
mov r8d, esi
mov rdx, rbx
mov ecx, edi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edi, eax
test eax, eax
je 0x1400030e0
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdx, qword [rsp + 0x58]
lea r9, [rsp + 0x50]
mov rcx, rax
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbx, rbx
je 0x1400030ee
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400035d0
Capabilities:
Delete file
Get common file path
Get hostname

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x880
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0x870], rax
xor ebx, ebx
mov rsi, r9
mov rdi, rdx
test cl, cl
je 0x1400036af
mov rdx, r8
mov rcx, rdi
call fcn.140003d70
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x450]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x450]
mov rdx, rdi
call fcn.140007808
test eax, eax
jne 0x14000366e
lea rcx, [rsp + 0x240]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x240]
call fcn.140009794
lea r8, [rsp + 0x240]
lea rdx, str._s_s
mov word [rax], bx
jmp 0x140003678
mov r8, rdi
lea rdx, str._sADMIN__s
lea rcx, [rsp + 0x30]
mov r9, rsi
call fcn.140007ff8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400036af
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400036af
lea ecx, [rax + 0x5f]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jb 0x140003685
cmp byte [0x14002f9e8], 0
je 0x1400036e2
lea rdx, str._sIPC_
lea rcx, [rsp + 0x660]
mov r8, rdi
call fcn.140007ff8
xor edx, edx
lea rcx, [rsp + 0x660]
lea r8d, [rdx + 1]
call sub.MPR.dll_WNetCancelConnection2W
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.140008390
add rsp, 0x880
pop rdi
pop rsi
pop rbx
ret

Function at 0x140003700
Capabilities:
Connect network resource

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebx, ebx
mov rsi, r8
mov rdi, rdx
mov word [rsp + 0x20], bx
cmp word [rdx], bx
jne 0x140003736
xor al, al
jmp 0x1400037bc
mov r8, rcx
lea rdx, str._sIPC_
lea rcx, [rsp + 0x60]
call fcn.140007ff8
xor eax, eax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x20]
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
mov rdx, rsi
mov dword [rsp + 0x2c], ebx
mov dword [rsp + 0x34], 3
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], rax
call sub.MPR.dll_WNetAddConnection2W
movzx ecx, byte [0x14002f9e8]
test eax, eax
mov edx, 1
cmove ecx, edx
sete al
mov byte [0x14002f9e8], cl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140008390
add rsp, 0x280
pop rdi
pop rsi
pop rbx
ret