joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002660
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002733
cmp byte [rcx + 0x71], 0
je 0x140002733
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000272f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400026f4
sub eax, 1
je 0x1400026f8
cmp eax, 2
jne 0x14000272f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002fa0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002726
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000272f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400026dc
xor al, al
jmp 0x1400026dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002fa0
add rsp, 0x60
pop rbx
ret

Function at 0x140003920
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000396a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000396a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000396a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000396a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000396a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000396c
xor al, al
add rsp, 0x28
ret
Function at 0x140001b20
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x3a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov rbx, qword [rsp + 0x400]
mov rsi, r9
mov rdi, qword [rsp + 0x408]
mov r9, rcx
mov r14, r8
mov ebp, edx
mov r12, rcx
lea r8, str._s
lea rcx, [rsp + 0x280]
mov edx, 0x104
call fcn.1400010c0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140001bb0
mov rdx, r12
lea rcx, str.____Failed_to_find_files_in_directory:__s_n
call fcn.140001060
jmp 0x140001d65
movzx ecx, byte [rsp + 0x5c]
movzx eax, byte [rsp + 0x5d]
cmp cl, 0x2e
jne 0x140001bda
test al, al
je 0x140001d46
cmp cl, cl
jne 0x140001bda
cmp al, cl
jne 0x140001bda
cmp byte [rsp + 0x5e], 0
je 0x140001d46
lea rax, [rsp + 0x5c]
mov r9, r12
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.1400010c0
test byte [rsp + 0x30], 0x10
je 0x140001c7c
mov r8, qword [rdi]
xor r9d, r9d
test r8, r8
je 0x140001c58
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x5c]
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001c43
inc rax
test ecx, ecx
jne 0x140001c30
test edx, edx
je 0x140001d46
mov r8, qword [rdi + r9*8 + 8]
inc r9
test r8, r8
jne 0x140001c20
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x170]
mov r9, rsi
mov qword [rsp + 0x20], rbx
mov r8, r14
mov edx, ebp
call fcn.140001b20
jmp 0x140001d46
mov edx, 0x2e
lea rcx, [rsp + 0x5c]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov r10, rax
test rax, rax
je 0x140001cd4
mov r8, qword [rsi]
xor r9d, r9d
test r8, r8
je 0x140001cd4
nop
mov rcx, r10
sub r8, r10
nop word [rax + rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140001cc3
inc rcx
test eax, eax
jne 0x140001cb0
test edx, edx
je 0x140001d46
mov r8, qword [rsi + r9*8 + 8]
inc r9
test r8, r8
jne 0x140001ca0
mov r8, qword [rbx]
xor r9d, r9d
test r8, r8
je 0x140001d14
nop
lea rax, [rsp + 0x5c]
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001d03
inc rax
test ecx, ecx
jne 0x140001cf0
test edx, edx
je 0x140001d46
mov r8, qword [rbx + r9*8 + 8]
inc r9
test r8, r8
jne 0x140001ce0
lea rax, [rsp + 0x5c]
mov r8, r14
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001d33
inc rax
test ecx, ecx
jne 0x140001d20
test edx, edx
je 0x140001d46
mov edx, ebp
lea rcx, [rsp + 0x170]
call fcn.1400017f0
lea rdx, [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001bb0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.140001da0
add rsp, 0x3a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140002660
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400026aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400026aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.api_ms_win_crt_runtime_l1_1_0.dll__seh_filter_exe
jne 0x1400026aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400026aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400026aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400026ac
xor al, al
add rsp, 0x28
ret
Function at 0x401f80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x00412048]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x98], rdi
mov rdi, rcx
lea rcx, [rsp + 0x48]
mov word [rsp + 0x48], 0x4b
mov word [rsp + 0x4a], 0x65
mov word [rsp + 0x4c], 0x72
mov word [rsp + 0x4e], 0x6e
mov word [rsp + 0x50], 0x65
mov word [rsp + 0x52], 0x6c
mov word [rsp + 0x54], 0x33
mov word [rsp + 0x56], 0x32
mov word [rsp + 0x58], 0x2e
mov word [rsp + 0x5a], 0x64
mov word [rsp + 0x5c], 0x6c
mov word [rsp + 0x5e], 0x6c
mov word [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r10d, r10d
mov byte [rsp + 0x28], 0x3d
mov byte [rsp + 0x29], 0x25
mov byte [rsp + 0x2a], 0x19
mov r11, rax
mov byte [rsp + 0x2b], 0x3d
mov byte [rsp + 0x2c], 0x18
mov byte [rsp + 0x2d], 3
mov byte [rsp + 0x2e], 7
mov byte [rsp + 0x2f], 0x1c
mov byte [rsp + 0x30], 0x19
mov byte [rsp + 0x31], 0x26
mov byte [rsp + 0x32], 0x19
mov byte [rsp + 0x33], 7
mov byte [rsp + 0x34], 8
mov byte [rsp + 0x35], 0x38
mov byte [rsp + 0x36], 0
mov word [rsp + 0x38], 0x6b
mov word [rsp + 0x3a], 0x4c
mov word [rsp + 0x3c], 0x6b
mov word [rsp + 0x3e], 0x49
mov word [rsp + 0x40], 0x6d
mov word [rsp + 0x42], 0x62
mov word [rsp + 0x44], 0
mov rcx, r10
lea rdx, [rsp + 0x28]
lea r8d, [r10 + 0xe]
cmp word [rsp + rcx*2 + 0x38], r10w
cmove rcx, r10
add rdx, 1
movzx eax, byte [rsp + rcx*2 + 0x38]
add rcx, 1
xor byte [rdx - 1], al
sub r8, 1
jne 0x402092
test r11, r11
je 0x4020c8
lea rdx, [rsp + 0x28]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
cmp qword [rdi + 0x20], 0x10
mov qword [rsp + 0x90], rbx
jb 0x4020e1
mov rcx, qword [rdi + 8]
lea rbx, [rdi + 8]
jmp 0x4020e8
lea rbx, [rdi + 8]
mov rcx, rbx
lea r9, [rsp + 0x20]
mov edx, 0x4e2
mov r8d, 0x40
call r10
cmp qword [rdi + 0x20], 0x10
mov rdi, qword [rsp + 0x98]
jb 0x40210d
mov rbx, qword [rbx]
call rbx
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.00403190
add rsp, 0x78
ret
Function at 0x402130
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbx
mov r11, rsp
sub rsp, 0xf0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x00412048]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov qword [r11 - 0x38], 7
xor ebx, ebx
mov qword [r11 - 0x40], rbx
mov word [r11 - 0x50], bx
mov qword [rsp + 0x20], rbx
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
call fcn.00401060
nop
lea r9, [rbx - 1]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.004027e0
nop
cmp qword [rsp + 0x60], 8
jb 0x4021b5
mov rcx, qword [rsp + 0x48]
call fcn.004033e0
cmp qword [rsp + 0xb0], 0
jne 0x4021df
cmp qword [rsp + 0xb8], 8
jb 0x4021d8
mov rcx, qword [rsp + 0xa0]
call fcn.004033e0
xor eax, eax
jmp 0x4023e7
mov r9w, 0x2f
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [rsp + 0x98]
call fcn.00402500
mov word [rsp + 0xd0], 4
mov word [rsp + 0xd2], 0xc
mov word [rsp + 0xd4], 5
mov word [rsp + 0xd6], 0x24
mov word [rsp + 0xd8], 0x3e
mov word [rsp + 0xda], 0x1c
mov word [rsp + 0xdc], 3
mov word [rsp + 0xde], 0x4b
mov word [rsp + 0xe0], 0xf
mov word [rsp + 0xe2], 0x20
mov word [rsp + 0xe4], 0x26
mov word [rsp + 0xe6], 0
mov word [rsp + 0xc0], 0x73
mov word [rsp + 0xc2], 0x65
mov word [rsp + 0xc4], 0x6b
mov word [rsp + 0xc6], 0x4c
mov word [rsp + 0xc8], 0x4a
mov word [rsp + 0xca], 0x68
mov word [rsp + 0xcc], 0
mov rcx, rbx
lea rdx, [rsp + 0xd0]
mov r8d, 0xb
nop
nop
nop
cmp word [rsp + rcx*2 + 0xc0], 0
cmove rcx, rbx
movzx eax, word [rsp + rcx*2 + 0xc0]
xor word [rdx], ax
add rdx, 2
add rcx, 1
sub r8, 1
jne 0x4022d0
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x90], 0xf
mov qword [rsp + 0x88], rbx
mov byte [rsp + 0x78], 0
xor r8d, r8d
mov edx, 0x4e2
lea rcx, [rsp + 0x70]
call fcn.00402e90
lea rcx, [rsp + 0x78]
cmp qword [rsp + 0x90], 0x10
cmovae rcx, qword [rsp + 0x78]
xor edx, edx
mov r8d, 0x4e2
call fcn.00404910
mov qword [rsp + 0x88], 0x4e2
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x90], 0x10
cmovae rax, qword [rsp + 0x78]
mov byte [rax + 0x4e2], 0
lea rcx, [rsp + 0x20]
call fcn.00401480
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], 0
mov r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.004027e0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.00401830
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.00401cd0
lea rcx, [rsp + 0x70]
call fcn.00401f80
xor ecx, ecx
call fcn.00403a10
nop
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.00403190
add rsp, 0xf0
pop rbx
ret
Function at 0x403e37
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00412048]
jne 0x4031aa
rol rcx, 0x10
test cx, 0xffff
jne 0x4031a6
repz ret
ror rcx, 0x10
jmp 0x403d90
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x00413360]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x00413458]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x403e15
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x00413360]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x403e37
mov rax, qword [rsp + 0x88]
mov qword [0x00413458], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x004133f8], rax
mov rax, qword [0x00413458]
mov qword [0x004132d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x004133e0], rax
mov dword [0x004132c0], 0xc0000409
mov dword [0x004132c4], 1
mov rax, qword [0x00412048]
mov qword [rsp + 0x68], rax
mov rax, qword [0x00412050]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x00413358], eax
mov ecx, 1
call fcn.00406ca0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0040d2f8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x00413358], 0
jne 0x403ebe
mov ecx, 1
call fcn.00406ca0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x407e70
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.00404b10
xor ebx, ebx
cmp qword [0x00413fd0], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x407fa1
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x407ed3
xor eax, eax
jmp 0x408081
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x407ecc
mov rcx, rax
call fcn.00404aa0
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x00413fd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00404aa0
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x00413fd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00404aa0
lea rcx, [rsp + 0x30]
mov qword [0x00413fe0], rax
call fcn.00403760
test eax, eax
je 0x407f57
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00404370
cmp dword [rsp + 0x30], 2
jne 0x407fa1
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00404aa0
test rax, rax
mov qword [0x00413ff0], rax
je 0x407fa1
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00404aa0
mov qword [0x00413fe8], rax
mov rcx, qword [0x00413fe8]
cmp rcx, rsi
je 0x408033
cmp qword [0x00413ff0], rsi
je 0x408033
call fcn.00404b70
call rax
test rax, rax
mov rbp, rax
je 0x407ffe
mov rcx, qword [0x00413ff0]
call fcn.00404b70
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x407ffe
test byte [rsp + 0x48], 1
jne 0x408033
lea rcx, [rsp + 0x34]
call fcn.004037b0
test eax, eax
je 0x408020
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00404370
cmp dword [rsp + 0x34], 4
jb 0x40802d
bts edi, 0x15
jmp 0x408067
bts edi, 0x12
jmp 0x408067
mov rcx, qword [0x00413fd8]
cmp rcx, rsi
je 0x408067
call fcn.00404b70
call rax
test rax, rax
mov rbx, rax
je 0x408067
mov rcx, qword [0x00413fe0]
cmp rcx, rsi
je 0x408067
call fcn.00404b70
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x00413fd0]
call fcn.00404b70
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140002130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x14000222b
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x140002233
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x14000226a
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x140002240
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x140002295
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x1400022bb
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x1400022a0
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x14000a6d0
Capabilities:
Read file on windows

Disassembly:
test rdx, rdx
je 0x14000a82d
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x60], r14
xor sil, sil
xor r14d, r14d
mov qword [rsp + 0x50], rbx
mov rdi, rdx
mov rbp, rcx
nop word [rax + rax]
mov rax, qword [0x1400314a8]
mov rcx, qword [0x1400314b0]
sub rax, rcx
je 0x14000a744
mov rdx, qword [0x1400314a0]
cmp rdi, rax
mov rbx, rdi
cmovae rbx, rax
add rdx, rcx
mov r8, rbx
mov rcx, rbp
call fcn.14000d020
add rbp, rbx
sub rdi, rbx
add qword [0x1400314b0], rbx
jmp 0x14000a813
mov rax, qword [0x14002f490]
cmp qword [0x14002f498], rax
jb 0x14000a7c7
test sil, sil
jne 0x14000a7c7
mov rcx, qword [0x1400314b8]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [0x1400314c0]
mov eax, eax
sub rcx, rax
je 0x14000a813
mov rdx, qword [0x14002f488]
lea r9, [rsp + 0x58]
mov ebx, 0x20003
mov qword [rsp + 0x20], r14
cmp rcx, rbx
cmovb rbx, rcx
mov rcx, qword [0x1400314b8]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
add qword [0x14002f470], rbx
mov qword [0x14002f498], r14
mov qword [0x14002f490], rbx
jmp 0x14000a813
mov rcx, qword [0x1400314c8]
lea r8, [0x14002f488]
lea rdx, [0x1400314a0]
mov qword [0x1400314b0], r14
mov qword [0x1400314a8], 0x20000
call fcn.140006ff0
mov rax, qword [0x1400314b0]
cmp rax, qword [0x1400314a8]
mov qword [0x1400314a8], rax
sete sil
mov qword [0x1400314b0], r14
test rdi, rdi
jne 0x14000a700
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000a890
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x80
mov rcx, qword [0x14002f480]
xor ebx, ebx
test rcx, rcx
je 0x14000a925
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne 0x14000a906
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov r8d, eax
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x90]
mov r9d, 0x400
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
lea rcx, str.Failed_to_send_CTRL_C_to_child_process.
call fcn.14000f8b8
mov rcx, qword [rsp + 0x90]
call fcn.14000f8b8
mov rcx, qword [0x14002f480]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x14002f480]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400314d0], bl
je 0x14000a975
lea rax, [0x14002f4a0]
mov qword [rsp + 0x40], rbx
lea rcx, [0x140029708]
mov qword [rsp + 0x50], rax
mov eax, 0x414
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x40]
mov word [rsp + 0x60], ax
mov dword [rsp + 0x48], 3
mov dword [rsp + 0x64], ebx
mov qword [rsp + 0x68], rbx
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
add rsp, 0x80
pop rbx
ret
Function at 0x14000bc68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bcb2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bcb2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bcb2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bcb2
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bcb2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bcb4
xor al, al
add rsp, 0x28
ret

Function at 0x14000f244
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000f0a3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f0a3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f0a3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f0a3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f0a3
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f0a3
cmp dword [rcx + 0xf8], 0
je 0x14000f0a3
mov ecx, ebx
call fcn.14000f160
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000ef30
nop
cmp dword [rbp + 0x20], 0
je 0x14000f0f1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f0fc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000f034
Function at 0x140019538
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140019568
xor eax, eax
jmp 0x14001962b
mov rbp, rbx
cmp word [rax], si
je 0x14001958d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140019574
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140019570
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140017af8
movsxd r14, eax
test eax, eax
jne 0x1400195cb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140019561
mov rcx, r14
call fcn.14001648c
mov rdi, rax
test rax, rax
jne 0x1400195e4
xor ecx, ecx
call fcn.140015568
jmp 0x1400195c0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140017af8
test eax, eax
jne 0x140019615
mov rcx, rdi
call fcn.140015568
jmp 0x14001961f
xor ecx, ecx
call fcn.140015568
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400201e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140020208
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140020208
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret