joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400020e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rsi, r8
mov dword [rsp + 0x20], 0x238
lea ecx, [rdx + 0xf]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002124
xor eax, eax
jmp 0x1400021a7
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140002199
mov qword [rsp + 0x280], rdi
nop dword [rax]
mov edi, dword [rsp + 0x28]
lea rdx, [0x1400045e8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.MSVCR90.dll__wcsicmp]
test eax, eax
je 0x14000216d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140002140
jmp 0x140002191
cmp dword [0x140006a54], 0
je 0x140002187
call fcn.140001c20
mov rdx, rsi
mov ecx, edi
call fcn.140001fc0
jmp 0x140002191
mov rdx, rsi
mov ecx, edi
call fcn.140001ea0
mov rdi, qword [rsp + 0x280]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400027c0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rsi
ret

Function at 0x1400021d0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x240
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], ax
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
lea r8, [rsp + 0x20]
xor edx, edx
repne scasw ax, word [rdi]
mov eax, dword [0x1400045b8]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
mov rax, qword [str.smsactive64.dll]
lea rcx, [0x1400045e8]
mov qword [rdi - 2], rax
mov rax, qword [0x1400045c8]
mov qword [rdi + 6], rax
mov rax, qword [0x1400045d0]
mov qword [rdi + 0xe], rax
mov rax, qword [0x1400045d8]
mov qword [rdi + 0x16], rax
call fcn.1400020e0
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400027c0
add rsp, 0x240
pop rdi
ret
Function at 0x1400022a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x380
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov rax, qword [str.SYSTEMControlSet001_servicesV3_Service]
mov rbx, rcx
lea rcx, [rsp + 0x150]
mov qword [rcx], rax
mov rax, qword [0x140004620]
xor edx, edx
mov qword [rcx + 8], rax
mov rax, qword [0x140004628]
mov r8d, 0xda
mov qword [rcx + 0x10], rax
mov rax, qword [0x140004630]
xor edi, edi
mov qword [rcx + 0x18], rax
mov rax, qword [0x140004638]
mov qword [rcx + 0x20], rax
movzx eax, word [0x140004640]
mov word [rcx + 0x28], ax
lea rcx, [rsp + 0x17a]
call sub.MSVCR90.dll_memset
lea r11, [rsp + 0x38]
lea rdx, [rsp + 0x150]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400023f3
lea rdx, [rsp + 0x260]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], dil
call sub.MSVCR90.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.ImagePath
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400023f3
lea edx, [rdi + 0x22]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_strrchr]
test rax, rax
je 0x1400023cd
mov byte [rax], dil
lea rax, [rsp + 0x41]
lea rcx, [rsp + 0x41]
sub rbx, rax
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rbx + rcx - 1], al
test al, al
jne 0x1400023e0
mov edi, 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002403
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.1400027c0
mov rbx, qword [rsp + 0x398]
add rsp, 0x380
pop rdi
ret
Function at 0x140002430
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [rsp + 0x78]
lea rdx, [0x140006020]
xor ebx, ebx
mov r9d, 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x60], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor r9d, r9d
test eax, eax
jne 0x1400024a4
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x68]
lea rdx, str.LOCAL_Value
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400024e4
lea ebx, [rax + 1]
jmp 0x140002519
lea rax, [rsp + 0x70]
lea rdx, [0x140006020]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20106
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140002519
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
lea rdx, str.LOCAL_Value
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140002529
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x50
pop rbx
ret

Function at 0x140002540
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
call fcn.140002430
test eax, eax
je 0x140002554
xor eax, eax
add rsp, 0x38
ret
lea rcx, [0x140006b70]
xor edx, edx
mov r8d, 0xfa0
call sub.MSVCR90.dll_memset
lea rdx, str._c_netsh_advfirewall_firewall_add_rule_name_BranchCache
lea rcx, [0x140006b70]
call qword [sym.imp.MSVCR90.dll__swprintf]
xor r11d, r11d
lea r9, [0x140006b70]
mov dword [rsp + 0x28], r11d
lea r8, [0x140004778]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1400025c0
Capabilities:
Create process on windows
Delete file
Get common file path
Set registry value

Disassembly:
push rbx
sub rsp, 0x490
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x480], rax
lea rcx, [rsp + 0x261]
xor ebx, ebx
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x260], bl
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], bl
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x260]
mov dword [rsp + 0x30], ebx
call fcn.1400022a0
test eax, eax
je 0x14000277f
call fcn.140002540
lea r11, [rsp + 0x38]
lea rdx, [0x140006020]
mov r9d, 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400026e1
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0x260]
lea rdx, str._c_netsh_advfirewall_firewall_set_rule_name_BranchCache
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, [rsp + 0x40]
lea r8, [0x1400047f8]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.LOCAL_Value
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x30], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400026f1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x371]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x370], 0
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x151]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x150], 0
call sub.MSVCR90.dll_memset
lea rdx, [rsp + 0x150]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, str.ssdx64.exe
lea r8, [rsp + 0x150]
lea rdx, [0x14000480c]
lea rcx, [rsp + 0x370]
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rcx, [rsp + 0x370]
call qword [sym.imp.MSVCR90.dll_remove]
lea rcx, str.c:windows_temp_rerx.exe
call qword [sym.imp.MSVCR90.dll_remove]
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400027c0
add rsp, 0x490
pop rbx
ret
Function at 0x140002b6b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x1400027da
rol rcx, 0x10
test cx, 0xffff
jne 0x1400027d6
repz ret
ror rcx, 0x10
jmp 0x140002ac4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140006350]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140006448]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140002b49
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140006350]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140002b6b
mov rax, qword [rsp + 0x88]
mov qword [0x140006448], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400063e8], rax
mov rax, qword [0x140006448]
mov qword [0x1400062c0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400063d0], rax
mov dword [0x1400062b0], 0xc0000409
mov dword [0x1400062b4], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140006008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140006348], eax
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140004340]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140006348], 0
jne 0x140002bf2
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x6349d0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x6349dd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x6349ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x6349d5
lea eax, [rcx + 1]
jmp 0x6349fb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x634a0e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x6349f4
sub eax, 3
jb 0x634a2e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x634a7d
sar eax, 1
movsxd rbp, eax
jb 0x634a64
jmp 0x634a3c
add ebx, ebx
jne 0x634a3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x634a64
inc ecx
add ebx, ebx
jne 0x634a4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x634a64
call r11
adc ecx, ecx
add ebx, ebx
jne 0x634a5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x634a4c
add ecx, 2
jmp 0x634a69
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00634992
jmp 0x6349dd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xcba00
mov dl, 0x22
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x634ac9
cmp rsi, rcx
jae 0x634ad1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x634ab0
cmp al, 0x8f
ja 0x634ab0
cmp byte [rsi - 2], 0xf
je 0x634ab6
sub al, 0xe8
cmp al, 1
ja 0x634a9a
cmp rsi, rcx
jae 0x634ad1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x634aa0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x634ad1
lodsb al, byte [rsi]
jmp 0x634ab0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x230000]
mov eax, dword [rdi]
or eax, eax
je 0x634b2e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x234000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x634ade
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x634b28
mov qword [rbx], rax
add rbx, 8
jmp 0x634afe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x634b68
cmp al, 0xef
ja 0x634b5a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x634b3a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x634b49
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x634bbc
sub rsp, 0xffffffffffffff80
jmp 0x463040
Function at 0x140005ea0
Capabilities:
Create pipe
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
movzx esi, r8b
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
cmp dword [rcx + 0x20], ebp
je 0x140005f11
mov dword [rcx + 0x20], ebp
cmp qword [rcx + 0x60], 0xffffffffffffffff
je 0x140005efe
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x60], 0xffffffffffffffff
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x140005f11
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x58], rbp
cmp rbx, rdi
je 0x140005f28
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.1400075c0
test sil, sil
je 0x140005fe3
mov ecx, Ordinal_41
call fcn.1400e193c
mov qword [rsp + 0x50], rax
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [rsp + 0x48], Ordinal_27
mov dword [rsp + 0x58], 1
cmp qword [rbx + 0x18], 0x10
jb 0x140005f7f
mov rcx, qword [rbx]
jmp 0x140005f82
mov rcx, rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0x200
mov r9d, VarUI2FromI4
xor r8d, r8d
mov edx, 0x80003
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rbx + 0x68], rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140005fc7
call fcn.1400e1934
cmp qword [rbx + 0x68], 0xffffffffffffffff
jne 0x140005fda
mov rcx, rdi
call fcn.140007010
xor al, al
jmp 0x140006029
lea r8, [0x140006c30]
jmp 0x140005fea
lea r8, [0x140006ab0]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x90], ebp
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x58], rax
cmp rax, rbp
je 0x140005fce
mov dword [rbx + 0x20], 1
mov rcx, rdi
call fcn.140007010
mov al, 1
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006da0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov ebp, r8d
mov dword [rsp + 0x60], r15d
mov rdi, rdx
mov r14, rcx
mov ebx, r15d
mov esi, r8d
test r8d, r8d
jle 0x140006e18
nop dword [rax]
nop dword [rax + rax]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], r15
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006e12
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140006e12
add ebx, eax
sub esi, eax
add rdi, rax
cmp ebx, ebp
jl 0x140006de0
jmp 0x140006e18
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rsp + 0x68]
cmp ebx, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
sete al
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140006e40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov ebp, r8d
mov rdi, rdx
mov r14, rcx
mov ebx, r15d
mov esi, r8d
test r8d, r8d
jle 0x140006e9c
nop
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], r15
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140006eba
mov eax, dword [rsp + 0x60]
add ebx, eax
sub esi, eax
add rdi, rax
cmp ebx, ebp
jl 0x140006e70
cmp ebx, ebp
sete al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
xor al, al
jmp 0x140006ea1

Function at 0x140008450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
xor eax, eax
mov r9d, eax
mov r10d, eax
cmp r10d, edi
jae 0x1400084de
inc eax
and eax, 0x800000ff
jge 0x140008487
dec eax
or eax, 0xffffff00
inc eax
movsxd r8, eax
movzx r11d, byte [r8 + rbx]
add r9d, r11d
and r9d, 0x800000ff
jge 0x1400084a8
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rdx, r9d
add rdx, rbx
movzx ecx, byte [rdx]
mov byte [r8 + rbx], cl
mov byte [rdx], r11b
movzx edx, byte [r8 + rbx]
mov r8d, r10d
add rdx, r11
movzx ecx, dl
movzx edx, byte [rcx + rbx]
movzx ecx, byte [r8 + rsi]
xor edx, ecx
mov byte [r8 + rsi], dl
inc r10d
jmp 0x140008470
mov al, 1
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x140008aa0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov r14, rdx
mov rdi, rcx
xor bl, bl
cmp qword [rcx + 0x18], 0x10
jb 0x140008ad1
mov rcx, qword [rcx]
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140008b44
mov dword [rsp + 0x80], ebp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov edx, eax
mov rcx, r14
call fcn.14000d0a0
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x80]
mov r8d, ebx
mov rdx, qword [r14]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rcx, rdi
call fcn.140007010
movzx eax, bl
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x140008b70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
xor dil, dil
mov rsi, rdx
cmp qword [rcx + 0x18], 0x10
mov rbx, rcx
jb 0x140008b9a
mov rcx, qword [rcx]
xor r14d, r14d
xor r9d, r9d
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140008c0e
mov r8d, dword [rsi + 8]
lea r9, [rsp + 0x60]
sub r8d, dword [rsi]
mov rcx, rax
mov rdx, qword [rsi]
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsi + 8]
mov eax, 1
sub rdx, qword [rsi]
mov ecx, dword [rsp + 0x60]
cmp rcx, rdx
movzx edi, dil
cmove edi, eax
mov rcx, rbx
call fcn.140007010
mov rbx, qword [rsp + 0x68]
movzx eax, dil
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140008cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor r8d, r8d
mov byte [rbp - 0x28], Ordinal_50
mov byte [rbp - 8], r8b
mov rbx, rcx
mov qword [rcx + 0x10], r8
mov word [rbp - 0x15], 0x6666
mov dword [rbp - 0x23], 0x38373065
mov word [rbp - 0x1b], 0x3166
mov word [rbp - 0xc], 0x6634
mov word [rbp - 0x12], 0x3665
mov word [rbp - 0x18], 0x6233
mov word [rbp - 0xf], 0x6235
mov dword [rbp - 0x1f], 0x35363963
mov byte [rbp - 0x13], Ordinal_50
mov byte [rbp - 0x10], Ordinal_50
mov byte [rbp - 0x19], reloc.WLDAP32.dll_Ordinal_50
mov word [rbp - 0xa], 0x6432
mov dword [rbp - 0x27], 0x64633733
mov byte [rbp - 0xd], Ordinal_50
mov byte [rbp - 0x16], reloc.WS2_32.dll_gethostname
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], r8b
mov dword [rbp - 0x30], r8d
cmp byte [rbp - 0x28], r8b
je 0x140008d5a
lea rax, [rbp - 0x28]
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008d50
lea rdx, [rbp - 0x28]
call fcn.1400080d0
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140008de0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov r14, rcx
xor sil, sil
cmp qword [rcx + 0x18], 0x10
jb 0x140008e08
mov rcx, qword [rcx]
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140008f8c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x98], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x98]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 4]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [rbx - 4]
mov esi, eax
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.14000b2a0
mov r8, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
sub r8, rbx
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x98]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r9, rbx
lea ecx, [rdi + 1]
test rsi, rsi
je 0x140008f1d
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9]
add ecx, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
lea r9, [r9 + 1]
lea r8d, [rdi + rcx]
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xfff1
sub r8d, eax
mov edi, r8d
sub rsi, 1
jne 0x140008ee0
shl edi, 0x10
add edi, ecx
cmp edi, dword [rsp + 0xa0]
sete sil
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140008f8c
mov rax, qword [rsp + 0x58]
sub rax, rbx
cmp rax, 0x1000
jb 0x140008f83
test bl, 0x1f
je 0x140008f56
call fcn.1400e462c
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x140008f65
call fcn.1400e462c
int3
sub rbx, rax
cmp rbx, 8
jae 0x140008f74
call fcn.1400e462c
int3
cmp rbx, 0x27
jbe 0x140008f80
call fcn.1400e462c
int3
mov rbx, rax
mov rcx, rbx
call fcn.14007b800
nop
mov rcx, r14
call fcn.140007010
movzx eax, sil
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret