joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021ed0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140021efe
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140021e20
cmp byte [0x14011deb8], 0
jne 0x140021f49
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140021f39
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14011deb8], 1
mov qword [0x14011deb0], rax
jmp 0x140021f50
mov rax, qword [0x14011deb0]
mov byte [0x14011deb8], 1
jmp 0x140021f50
mov rax, qword [0x14011deb0]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140021f6f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
Function at 0x140021f80
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rbp + 0x200], rax
xor r13d, r13d
lea rcx, [rbp - 0x7f]
xor edx, edx
lea r8d, [r13 + 0x63]
mov esi, r13d
xor r12b, r12b
mov dword [rsp + 0x60], r13d
mov byte [rbp - 0x80], sil
call sub.MSVCR100.dll_memset
xor eax, eax
lea rdx, [rbp - 0x80]
lea rdi, [rbp - 0x10]
mov ecx, 0x208
mov dword [rsp + 0x78], esi
mov word [rsp + 0x7c], 0x500
rep stosb byte [rdi], al
lea rdi, [rbp - 0x10]
mov ecx, 0x208
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x68], r13
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea rdx, [rsp + 0x68]
mov ecx, eax
call sub.WTSAPI32.dll_WTSQueryUserToken
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140022161
cmp rcx, 0xffffffffffffffff
je 0x140022161
mov r9d, dword [rsp + 0x60]
lea rax, [rsp + 0x60]
lea edx, [r13 + 2]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14002205a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140022129
mov edx, dword [rsp + 0x60]
mov ecx, reloc.ATL100.DLL_Ordinal_64
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x140022129
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov r8, rsi
mov edx, 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140022129
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov r8d, reloc.ATL100.DLL_Ordinal_32
mov dl, 2
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140022129
mov edi, r13d
cmp dword [rsi], r13d
jbe 0x140022129
mov qword [rsp + 0x330], rbx
lea rbx, [rsi + 8]
nop dword [rax + rax]
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14002211e
inc edi
add rbx, 0x10
cmp edi, dword [rsi]
jb 0x140022100
jmp 0x140022121
mov r12b, 1
mov rbx, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002213e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140022153
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rsp + 0x70], r13
test rsi, rsi
je 0x140022161
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
movzx eax, r12b
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1400cafa0
lea r11, [rsp + 0x310]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
Function at 0x140022350
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
lea rdi, [rsp + 0x38]
mov ecx, Ordinal_20
xor bl, bl
mov qword [rsp + 0x30], 0
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, Ordinal_44
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14002240d
lea r8, [rsp + 0x3c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov edi, 1
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x44], 2
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002240d
lea ecx, [rdi + 5]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
movzx ecx, bl
test eax, eax
cmovne ecx, edi
movzx eax, cl
jmp 0x140022410
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cafa0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140022430
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
lea rdi, [rsp + 0x38]
mov ecx, Ordinal_20
xor bl, bl
mov qword [rsp + 0x30], 0
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, Ordinal_44
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400224ed
lea r8, [rsp + 0x3c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov edi, 1
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x44], 2
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400224ed
lea ecx, [rdi + 0xc]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
movzx ecx, bl
test eax, eax
cmovne ecx, edi
movzx eax, cl
jmp 0x1400224f0
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cafa0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400225e0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
mov eax, dword [rdx]
mov dword [rcx + 0x74], eax
xor eax, eax
cmp dword [rdx], 1
jne 0x1400226a0
lea rcx, [r11 + 8]
lea rdx, str.SOFTWARESony_CorporationVAIO_Update
xor r9d, r9d
mov qword [r11 - 0x38], rcx
lea rcx, [r11 + 0x10]
xor r8d, r8d
mov qword [r11 - 0x40], rcx
mov qword [r11 - 0x48], rax
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov qword [r11 + 0x10], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140022709
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x90], rdi
lea rdi, str.Offline
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str.VUMode
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x90]
test rbx, rbx
je 0x140022709
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x70
pop rbx
ret
lea r8, str.SOFTWARESony_CorporationVAIO_Update
lea rcx, [rsp + 0x50]
mov r9d, 0x2001f
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x60], rax
call fcn.140008440
test eax, eax
jne 0x1400226f9
mov rbx, qword [rsp + 0x50]
lea rdx, str.VUMode
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test rbx, rbx
je 0x140022709
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x70
pop rbx
ret
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140022709
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x70
pop rbx
ret
Function at 0x1400228f0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rdi, rdx
mov rbx, rcx
xor eax, eax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
xor edx, edx
lea rcx, [r11 - 0x38]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x140022952
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140022948
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x140022952
mov ecx, eax
call fcn.140001000
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rdi]
mov dword [rbx + 0x54], r11d
xor ecx, ecx
mov qword [rsp + 0x50], rcx
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWARESony_CorporationVAIO_Update5.0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400229fb
mov rbx, qword [rsp + 0x50]
mov eax, dword [rdi]
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Trigger
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1400229fb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x140023690
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x240
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, rdx
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], ax
call sub.MSVCR100.dll_memset
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
setne bl
test bl, bl
je 0x140023744
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x250], rdi
xor eax, eax
lea rdi, [rsp + 0x20]
lea rdx, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rsi
call fcn.140001e80
lea rdx, str.Sony_CorporationVAIO_Update
mov r8d, Ordinal_32
mov rcx, rsi
call fcn.140003c10
lea rdx, str.VAUBondingPatchList.dat
mov r8d, 0x18
mov rcx, rsi
call fcn.140003c10
mov rdi, qword [rsp + 0x250]
movzx eax, bl
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400cafa0
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rsi
ret
Function at 0x140024130
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rcx
xor dil, dil
mov eax, dword [rcx + 0x50]
cmp eax, 7
je 0x140024157
cmp eax, 8
jne 0x1400241b9
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140023690
mov rbx, qword [rsp + 0x40]
test al, al
je 0x14002419e
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
movzx edi, dil
mov ecx, 1
test eax, eax
cmovne edi, ecx
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400241b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movzx eax, dil
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140024ac0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rbx, rdx
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x90], rdi
xor r12d, r12d
or rsi, 0xffffffffffffffff
test rbx, rbx
je 0x140024b4a
test rbx, 0xffffffffffff0000
jne 0x140024b37
movzx ebx, bx
xor edx, edx
mov ecx, ebx
call fcn.1400017e0
test rax, rax
je 0x140024b68
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140001f70
jmp 0x140024b60
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x140024b4d
mov ecx, r12d
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x90]
call fcn.140001e80
mov rdi, qword [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140024c2e
mov ebp, dword [rdi - 0x10]
lea ebx, [rbp + 1]
test ebx, ebx
jns 0x140024b8e
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140024bb6
mov edx, ebx
lea rcx, [rsp + 0x90]
call fcn.140001c20
mov rdi, qword [rsp + 0x90]
mov word [rdi + rbp*2], r12w
cmp ebx, dword [rdi - 0xc]
jg 0x140024c23
mov dword [rdi - 0x10], ebx
movsxd rax, ebx
mov word [rdi + rax*2], r12w
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov eax, 0x614
mov word [rsp + 0x48], ax
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x28]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
jmp 0x140024c2e
mov ecx, 0x80070057
call fcn.140001000
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140024c46
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400386d0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r12d, edx
mov qword [rsp + 0x50], rbx
mov eax, 0xaaaaaaab
mov ebp, r12d
mov rdi, r9
mov rsi, r8
mul edx
mov ebx, edx
mov r14, rcx
shr ebx, 1
lea eax, [rbx + rbx*2]
sub ebp, eax
lea eax, [rbx*4 + 1]
je 0x140038715
lea eax, [rbx*4 + 5]
mov ecx, eax
mov dword [r9], eax
call fcn.1400ca8e8
xor r10d, r10d
lea r15, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov qword [rsi], rax
mov ecx, dword [rdi]
mov rdi, rax
xor eax, eax
rep stosb byte [rdi], al
test ebx, ebx
je 0x1400387e1
mov qword [rsp + 0x58], r13
lea r11d, [rax + 2]
mov r10d, ebx
lea r13, [r14 + 2]
nop dword [rax]
movzx edi, byte [r13 - 2]
movzx r9d, byte [r13 - 1]
movzx r8d, byte [r13]
mov rcx, qword [rsi]
movzx eax, r9b
and r9b, 0xf
shr al, 4
movzx edx, dil
shl r9b, 2
and dl, 3
shr rdi, 2
add r11, 4
shl dl, 4
add r13, 3
or dl, al
movzx eax, r8b
and r8b, 0x3f
shr al, 6
or r9b, al
dec rbx
movzx eax, byte [rdi + r15]
mov byte [r11 + rcx - 6], al
mov rcx, qword [rsi]
movzx eax, dl
movzx eax, byte [rax + r15]
mov byte [r11 + rcx - 5], al
mov rcx, qword [rsi]
movzx eax, r9b
movzx eax, byte [rax + r15]
mov byte [r11 + rcx - 4], al
mov rcx, qword [rsi]
movzx eax, r8b
movzx eax, byte [rax + r15]
mov byte [r11 + rcx - 3], al
jne 0x140038750
mov r13, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
shl r10d, 2
test ebp, ebp
jne 0x140038807
mov rax, qword [rsi]
mov byte [r10 + rax], bpl
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp ebp, 1
jne 0x140038851
mov rcx, qword [rsi]
lea eax, [r12 - 1]
movzx eax, byte [rax + r14]
movzx edi, al
shr rax, 2
movzx eax, byte [rax + r15]
and dil, 3
mov byte [r10 + rcx], al
mov rcx, qword [rsi]
inc r10d
shl dil, 4
movzx eax, dil
movzx eax, byte [rax + r15]
mov byte [r10 + rcx], al
mov rax, qword [rsi]
inc r10d
mov byte [r10 + rax], reloc.ATL100.DLL_Ordinal_61
jmp 0x1400388b7
lea ecx, [r12 - 2]
movzx r8d, byte [rcx + r14]
lea eax, [rcx + 1]
mov rcx, qword [rsi]
movzx r9d, byte [rax + r14]
movzx edi, r8b
shr r8, 2
movzx eax, r9b
and dil, 3
and r9b, 0xf
shr al, 4
shl dil, 4
shl r9b, 2
or dil, al
movzx eax, byte [r8 + r15]
mov byte [r10 + rcx], al
mov rcx, qword [rsi]
inc r10d
movzx eax, dil
movzx eax, byte [rax + r15]
mov byte [r10 + rcx], al
mov rcx, qword [rsi]
movzx eax, r9b
movzx eax, byte [rax + r15]
inc r10d
mov byte [r10 + rcx], al
mov rax, qword [rsi]
mov rbp, qword [rsp + 0x60]
inc r10d
mov byte [r10 + rax], reloc.ATL100.DLL_Ordinal_61
mov rax, qword [rsi]
lea ecx, [r10 + 1]
mov byte [rcx + rax], 0
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14003fae0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, 1
test r8d, r8d
je 0x14003fb18
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rdi
xor edi, edi
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
cmove ebx, edi
mov rdi, qword [rsp + 0x40]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14003fb20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, 1
test r8d, r8d
je 0x14003fb58
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rdi
xor edi, edi
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
cmove ebx, edi
mov rdi, qword [rsp + 0x40]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14003fbb0
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rax, qword [rsp + 0x38]
add rsp, 0x28
ret

Function at 0x14003fbe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
mov ecx, edi
setne bl
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140040220
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0xb8], 0
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, [0x1400de328]
test rdx, 0xffffffffffff0000
jne 0x1400402a1
movzx ebx, dx
xor edx, edx
mov ecx, ebx
call fcn.1400017e0
test rax, rax
je 0x1400402af
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140001f70
jmp 0x1400402af
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.140001e80
nop
mov rdx, rbp
mov rcx, rsi
call fcn.14003ffa0
test al, al
jne 0x1400402d8
mov rbx, qword [rsp + 0x38]
lea rcx, [rbx - 0x18]
call fcn.140001b90
add rax, 0x18
mov qword [rdi], rax
jmp 0x140040395
lea rdx, [rsp + 0xb8]
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test eax, eax
je 0x140040380
mov ecx, ebx
call fcn.1400ca8e8
mov rsi, rax
mov r9, rax
mov r8d, ebx
xor edx, edx
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140040378
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [0x1400ddd20]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140040378
lea rcx, [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov r8d, Ordinal_56
call sub.MSVCR100.dll_memcpy
mov r11, qword [rsp + 0x58]
mov rcx, r11
shr rcx, 0x20
movzx eax, cx
shr ecx, 0x10
movzx r9d, r11w
shr r11d, 0x10
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r8d, r11d
lea rdx, str._d._d._d._d
lea rcx, [rsp + 0x38]
call fcn.140004440
mov rcx, rsi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov rbx, qword [rsp + 0x38]
lea rcx, [rbx - 0x18]
call fcn.140001b90
add rax, 0x18
mov qword [rdi], rax
or eax, 0xffffffff
lock xadd dword [rbx - 8], eax
dec eax
test eax, eax
jg 0x1400403b1
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + 8]
mov rax, rdi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140040cb0
Capabilities:
Check http status code
Read http header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
lea rcx, [rsp + 0x42]
xor edi, edi
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0x40], di
call sub.MSVCR100.dll_memset
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea edx, [rdi + 0x13]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
setne al
test al, al
je 0x140040d32
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR100.dll__wtoi]
cmp eax, 0xc8
sete al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400cafa0
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x140040d60
Capabilities:
Get session user name
Impersonate user

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rbx, r8
mov rsi, rdx
lea rdi, [r11 - 0x40]
xor eax, eax
mov ecx, reloc.ATL100.DLL_Ordinal_56
rep stosb byte [rdi], al
mov dword [rsp + reloc.ATL100.DLL_Ordinal_56], 0x38
mov dword [rsp + 0x20], eax
lea rdx, [r11 - 0x58]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ecx, dword [rsp + 0x20]
test eax, eax
jne 0x140040db4
test ecx, ecx
je 0x140040eef
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ca8e8
mov rdi, rax
test rax, rax
je 0x140040eef
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x140040dfa
mov rcx, rdi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
jmp 0x140040eef
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x28]
call sub.WTSAPI32.dll_WTSQueryUserToken
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140040ded
lea rdx, [rsp + 0x38]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
jne 0x140040e4b
mov rcx, rdi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140040eef
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x140040e7f
mov rcx, rdi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140040eef
lea rcx, [rsp + 0x98]
call fcn.1400386c0
nop
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x98]
call fcn.1400027c0
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x140040eba
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140040eba
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140040ed9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
mov rcx, rdi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
nop
lea rcx, [rsp + 0x98]
call fcn.1400036a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret