joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b010
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rsp + 0x60]
lea ebx, [r8 - 0x2fd]
mov edx, ecx
xor ecx, 0xdc6
xor edx, 0xbeb
lea edi, [rax - 0x35a4]
lea r11d, [rax - 0x767]
mov eax, ebx
xor eax, 0x163b
cmp edi, eax
jg 0x18000b0d6
cmp dword [r9 + 0x140], 0x4d5
je 0x18000b068
add dword [0x180059074], 0xfffffcf2
jmp 0x18000b088
mov rdx, qword [section..data]
mov ecx, dword [r9 + 0x1c]
sub ecx, 0x26bf7
mov eax, dword [rdx + 0x140]
imul eax, ecx
mov dword [rdx + 0x140], eax
cmp dword [0x1800590fc], 0xc5c4
jae 0x18000b0ba
mov eax, dword [r9 + 0xd0]
mov ecx, dword [r9 + 0x1c]
sub ecx, dword [0x180059144]
add ecx, dword [0x180059050]
imul eax, ecx
mov dword [r9 + 0xd0], eax
jmp 0x18000b148
mov rax, qword [section..data]
mov ecx, dword [rax + 0x60]
sub ecx, dword [rax + 0x148]
sub ecx, 0x13e9ab
xor dword [r9 + 0x64], ecx
jmp 0x18000b148
mov eax, dword [r9 + 0x70]
or eax, edi
cmp edx, eax
jne 0x18000b148
mov eax, dword [r9 + 0xdc]
mov r8, qword [section..data]
or eax, ebx
and eax, 0x2e1e
cmp dword [r8 + 0x5c], eax
jbe 0x18000b14f
add ecx, dword [0x180059034]
mov r10d, dword [r8 + 0x50]
sub edi, ecx
sub r11d, dword [r8 + 0x148]
mov ecx, dword [r8 + 0xd0]
imul r11d, dword [r8 + 0x18]
and ecx, ebx
mov r9d, dword [r9 + 0x28]
add r10d, dword [0x180059060]
add r9d, edx
sub ecx, dword [0x180059110]
movsxd rdx, ebx
mov r8d, r11d
mov qword [rsp + 0x20], r10
or rdx, 0x2df9
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8, qword [section..data]
lea eax, [rbx - 0x5fb]
cmp edi, eax
jge 0x18000b168
mov eax, dword [r8 + 0x10]
xor eax, 0xf2
sub dword [0x180059074], eax
lea eax, [rbx + 0x3ca]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140001000
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400014b0
mov dword [rsp + 0x70], 0x68
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x100]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140001152
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x118]
mov dword [rax], 0xffffffff
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0xe0]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 1
jne 0x140001112
mov edx, dword [rsp + 0x60]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne 0x140001104
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._nspawn.exe:_filed_to_terminate_process_with_error:_0x_x_n
call fcn.1400013cc
jmp 0x140001112
mov rax, qword [rsp + 0x118]
mov dword [rax], 0xfffffffe
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140001168
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
mov rax, qword [rsp + 0x118]
mov dword [rax], r11d
xor eax, eax
add rsp, 0xf8
ret

Function at 0x140003478
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400032e0
Function at 0x1400066f4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140004260
xor ebx, ebx
mov rdi, rax
cmp qword [0x14000eca0], rbx
jne 0x1400067fa
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400068cf
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400068cf
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000eca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000eca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14000ecb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14000ecc0], rax
test rax, rax
je 0x1400067f1
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14000ecb8], rax
jmp 0x140006801
mov rax, qword [0x14000ecb8]
jmp 0x140006808
mov rax, qword [0x14000ecb8]
mov r11, qword [0x14000ecc0]
cmp rax, rdi
je 0x140006870
cmp r11, rdi
je 0x140006870
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14000ecc0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140006870
test rax, rax
je 0x140006870
call rsi
test rax, rax
je 0x14000686a
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000686a
test byte [rsp + 0x38], 1
jne 0x140006870
bts ebp, 0x15
jmp 0x1400068ae
mov rcx, qword [0x14000eca8]
cmp rcx, rdi
je 0x1400068ae
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400068ae
call rax
mov rbx, rax
test rax, rax
je 0x1400068ae
mov rcx, qword [0x14000ecb0]
cmp rcx, rdi
je 0x1400068ae
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400068ae
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000eca0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400068cf
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400068d1
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140008caf
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000d650]
jne 0x14000610a
rol rcx, 0x10
test cx, 0xffff
jne 0x140006106
repz ret
ror rcx, 0x10
jmp 0x140008c08
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000ed80]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14000ee78]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140008c8d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000ed80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140008caf
mov rax, qword [rsp + 0x88]
mov qword [0x14000ee78], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000ee18], rax
mov rax, qword [0x14000ee78]
mov qword [0x14000ecf0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000ee00], rax
mov dword [0x14000ece0], 0xc0000409
mov dword [0x14000ece4], 1
mov rax, qword [0x14000d650]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000d658]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000ed78], eax
mov ecx, 1
call fcn.140006110
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000b4f8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000ed78], 0
jne 0x140008d36
mov ecx, 1
call fcn.140006110
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x417fb0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x18
mov edx, dword [rcx + 4]
lea r8, str.cw
mov ecx, dword [rcx + 0xc]
mov eax, edx
movzx r9d, dl
shr eax, 0x18
movzx r11d, byte [r8 + r9]
movzx r10d, byte [r8 + rax]
mov eax, edx
movzx edx, dh
shr eax, 0x10
movzx r9d, al
movzx eax, byte [r8 + rdx]
movzx edx, cl
shl r10d, 0x18
or r10d, r11d
movzx r11d, byte [r8 + r9]
mov r9d, ecx
shr r9d, 0x18
shl eax, 8
shl r11d, 0x10
or r10d, r11d
movzx r11d, byte [r8 + r9]
mov r9d, ecx
or r10d, eax
movzx eax, byte [r8 + rdx]
shr r9d, 0x10
movzx edx, r9b
movzx ecx, ch
mov r9d, r10d
ror r9d, 8
shl r11d, 0x18
mov dword [rsp + 4], r9d
or r11d, eax
movzx eax, byte [r8 + rdx]
movzx r8d, byte [r8 + rcx]
movd xmm3, dword [rsp + 4]
shl eax, 0x10
shl r8d, 8
or r11d, eax
or r11d, r8d
mov edx, r11d
mov dword [rsp + 0xc], r11d
ror edx, 8
movd xmm1, dword [rsp + 0xc]
mov dword [rsp + 8], edx
movd xmm2, dword [rsp + 8]
mov dword [rsp + 8], r10d
movd xmm0, dword [rsp + 8]
punpckldq xmm1, xmm2
punpckldq xmm0, xmm3
punpcklqdq xmm0, xmm1
add rsp, 0x18
ret
Function at 0x418690
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rsp + 0x28]
mov r10, qword [rsp + 0x50]
movdqa xmm3, xmmword [rcx]
mov r11, qword [rsp + 0x58]
movdqa xmm4, xmm3
movdqa xmm2, xmmword [rcx + 0x10]
mov rcx, qword [rsp + 0x38]
pslldq xmm4, 4
movdqa xmm0, xmm4
aeskeygenassist xmm5, xmm2, 1
movaps xmmword [rdx], xmm3
pslldq xmm0, 4
movdqa xmm1, xmm0
mov rdx, qword [rsp + 0x30]
pxor xmm0, xmm4
pslldq xmm1, 4
pshufd xmm5, xmm5, 0xff
movaps xmmword [r8], xmm2
pxor xmm3, xmm0
mov r8, qword [rsp + 0x40]
pxor xmm3, xmm1
pxor xmm5, xmm3
aeskeygenassist xmm3, xmm5, 0
movaps xmmword [r9], xmm5
mov r9, qword [rsp + 0x48]
pshufd xmm4, xmm3, 0xaa
movdqa xmm3, xmm2
pslldq xmm3, 4
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pxor xmm1, xmm3
pslldq xmm0, 4
pxor xmm2, xmm1
movdqa xmm1, xmm5
pxor xmm2, xmm0
pslldq xmm1, 4
movdqa xmm0, xmm1
pxor xmm4, xmm2
pslldq xmm0, 4
pxor xmm1, xmm0
aeskeygenassist xmm2, xmm4, 2
movaps xmmword [rax], xmm4
pshufd xmm3, xmm2, 0xff
movdqa xmm2, xmm0
movdqa xmm0, xmm4
pslldq xmm2, 4
pxor xmm1, xmm2
pslldq xmm0, 4
pxor xmm1, xmm3
movdqa xmm3, xmm1
movdqa xmm1, xmm0
pxor xmm3, xmm5
pslldq xmm1, 4
pxor xmm0, xmm1
aeskeygenassist xmm5, xmm3, 0
movaps xmmword [rdx], xmm3
pshufd xmm2, xmm5, 0xaa
movdqa xmm5, xmm1
movdqa xmm1, xmm3
pslldq xmm5, 4
pxor xmm0, xmm5
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm2, xmm0
movdqa xmm0, xmm1
pxor xmm2, xmm4
pslldq xmm0, 4
pxor xmm1, xmm0
movdqa xmm5, xmm0
aeskeygenassist xmm4, xmm2, 4
pslldq xmm5, 4
pxor xmm1, xmm5
movdqa xmm0, xmm2
movaps xmmword [rcx], xmm2
pshufd xmm4, xmm4, 0xff
pslldq xmm0, 4
pxor xmm1, xmm4
pxor xmm1, xmm3
aeskeygenassist xmm3, xmm1, 0
movaps xmmword [r8], xmm1
pshufd xmm4, xmm3, 0xaa
movdqa xmm3, xmm0
pslldq xmm3, 4
pxor xmm0, xmm3
movdqa xmm5, xmm3
pslldq xmm5, 4
pxor xmm0, xmm5
pxor xmm0, xmm4
movdqa xmm4, xmm1
pxor xmm0, xmm2
pslldq xmm4, 4
aeskeygenassist xmm2, xmm0, 8
movaps xmmword [r9], xmm0
pshufd xmm3, xmm2, 0xff
movdqa xmm2, xmm4
pslldq xmm2, 4
movdqa xmm5, xmm2
pxor xmm2, xmm4
movdqa xmm4, xmm0
pslldq xmm5, 4
pslldq xmm4, 4
pxor xmm2, xmm5
pxor xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm2, xmm4
aeskeygenassist xmm3, xmm1, 0
pslldq xmm2, 4
movdqa xmm5, xmm2
pxor xmm2, xmm4
movaps xmmword [r10], xmm1
pshufd xmm3, xmm3, 0xaa
pslldq xmm5, 4
pxor xmm2, xmm5
pxor xmm2, xmm3
pxor xmm0, xmm2
movaps xmmword [r11], xmm0
ret
Function at 0x43f500
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rdx, [0x0043f1b0]
mov rbx, rcx
lea rcx, [0x0054c840]
call fcn.00455de0
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
mov qword [rbx + 0x38], rax
je 0x43f761
mov rcx, rbx
mov qword [rbx + 0x40], 0
lea rbp, [rbx + 0xc8]
call fcn.00456990
lea rax, [rbx + 0xb8]
mov dword [rbx + 0x20], 0
mov dword [rbx + 8], 0
mov qword [rbx + 0x48], 0
mov qword [rbx + 0x50], 0
mov rcx, rbp
mov qword [rbx + 0xb8], rax
mov qword [rbx + 0xc0], rax
lea rax, [rbx + 0x10]
mov qword [rbx + 0x58], 0
mov qword [rbx + 0x68], 0
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x60], 0
mov qword [rbx + 0x70], 0
mov qword [rbx + 0x78], 0
mov qword [rbx + 0x80], 0
mov qword [rbx + 0x88], 0
mov qword [rbx + 0x90], 0
mov qword [rbx + 0x98], 0
mov qword [rbx + 0xa0], 0
mov dword [rbx + 0xa8], 0
mov dword [rbx + 0xac], 0
mov qword [rbx + 0xb0], 0
mov dword [rbx + 0x30], 0
call fcn.00455fb0
test eax, eax
mov esi, eax
je 0x43f650
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov qword [rbx + 0x38], 0xffffffffffffffff
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [rbx + 0xf0]
lea r8, [0x0043ce50]
mov rcx, rbx
call fcn.0043ef90
test eax, eax
mov esi, eax
jne 0x43f704
mov eax, dword [rbx + 0x148]
test al, 0x20
je 0x43f6a3
mov edx, eax
and edx, 0xffffffdf
test al, 1
mov dword [rbx + 0x148], edx
jne 0x43f780
and eax, 0x40
mov ecx, eax
mov eax, edx
test ecx, ecx
je 0x43f6a3
mov rdx, qword [rbx + 0xf8]
sub dword [rdx + 8], 1
or al, 0x80
lea rcx, [0x0054c800]
mov dword [rbx + 0x148], eax
call sub.KERNEL32.dll_EnterCriticalSection
mov edi, dword [0x0054c82c]
cmp edi, dword [0x0054c828]
je 0x43f711
mov rax, qword [0x0054c830]
movsxd rdx, edi
lea rcx, [0x0054c800]
add edi, 1
mov qword [rax + rdx*8], rbx
mov dword [0x0054c82c], edi
call fcn.00456030
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [0x0054c800]
mov esi, 0xe
call fcn.00456030
mov rcx, rbp
call sub.KERNEL32.dll_DeleteCriticalSection
jmp 0x43f62c
add edi, 8
mov rcx, qword [0x0054c830]
movsxd rdx, edi
shl rdx, 3
call fcn.0043d4a0
test rax, rax
je 0x43f6f3
movsxd rdx, dword [0x0054c828]
mov qword [0x0054c830], rax
cmp edi, edx
jle 0x43f750
nop
mov qword [rax + rdx*8], 0
add rdx, 1
cmp edi, edx
jg 0x43f740
mov dword [0x0054c828], edi
mov edi, dword [0x0054c82c]
jmp 0x43f6cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.00440300
mov eax, edx
jmp 0x43f6a3
Function at 0x440a00
Capabilities:
Get common file path

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbp, rdx
mov r12, r8
call sub.msvcrt.dll_wcslen
test rax, rax
mov rdi, rax
je 0x440a59
lea rbx, [rax - 1]
movzx eax, word [rsi + rbx*2]
cmp ax, 0x5c
je 0x440ab0
cmp ax, 0x2f
jne 0x440a54
jmp 0x440ab0
sub rbx, 1
movzx eax, word [rsi + rbx*2]
cmp ax, 0x2f
je 0x440ab0
cmp ax, 0x5c
je 0x440ab0
test rbx, rbx
jne 0x440a40
test rbp, rbp
je 0x440a8b
mov ecx, 0x20a
call fcn.0043d450
test rax, rax
mov qword [rbp], rax
je 0x440b46
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x440b2e
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
mov qword [r12], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test rbx, rbx
je 0x440a59
test rbp, rbp
je 0x440aeb
lea r13, [rbx + rbx + 4]
mov rcx, r13
call fcn.0043d450
test rax, rax
mov qword [rbp], rax
je 0x440b46
lea r8, [rbx + 1]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_wcsncpy
mov rax, qword [rbp]
xor ecx, ecx
mov word [rax + r13 - 2], cx
sub rdi, rbx
lea rbp, [rdi + rdi]
mov rcx, rbp
call fcn.0043d450
test rax, rax
mov qword [r12], rax
je 0x440b46
lea rdx, [rsi + rbx*2 + 2]
lea r8, [rdi - 1]
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rax, qword [r12]
xor edx, edx
mov word [rax + rbp - 2], dx
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, qword [rbp]
call fcn.0043d460
mov qword [rbp], 0
mov eax, 0xffffffff
jmp 0x440b21
lea rdx, [0x0051ad20]
mov ecx, 0xe
call fcn.00440240
nop
nop dword [rax + rax]
Function at 0x4420c0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov r14, rcx
mov ecx, dword [rcx + 0x150]
cmp ecx, 0xffffffff
je 0x442213
mov rsi, qword [r14 + 0x180]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x44228c
cmp rsi, 0xffffffffffffffff
je 0x442230
xor edx, edx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov r9d, 1
lea r8, [rsp + 0x48]
mov rcx, rax
lea rbp, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne al
movzx eax, al
mov dword [rsp + 0x3c], eax
xor ebx, ebx
xor r15d, r15d
lea r13, [rsp + 0x44]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x442171
cmp ebx, dword [r14 + 0x170]
jae 0x4421f0
cmp rsi, 0xffffffffffffffff
je 0x442189
mov eax, r15d
add rax, rsi
mov dword [rsp + 0x60], eax
sar rax, 0x20
mov dword [rsp + 0x64], eax
mov eax, ebx
mov r9, r13
mov rcx, rdi
shl rax, 4
add rax, qword [r14 + 0x178]
add ebx, 1
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], rbp
mov r8d, dword [rax]
call r12
mov r11d, dword [rsp + 0x44]
add r11d, r15d
test eax, eax
mov r15d, r11d
jne 0x442164
mov edx, dword [rsp + 0x3c]
xor ebx, ebx
test edx, edx
jne 0x442245
test r11d, r11d
jne 0x4421f8
test bl, bl
jne 0x4421f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x442270
mov qword [r14 + 0x88], 0
jmp 0x442202
mov eax, dword [rsp + 0x3c]
test eax, eax
jne 0x442240
mov eax, r11d
mov qword [r14 + 0x88], rax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [r14 + 0x88], 0xfffffffffffff00d
mov dword [r14 + 0x14c], 6
jmp 0x442202
mov dword [rsp + 0x3c], 0
xor ebp, ebp
jmp 0x442151
mov ebx, 1
mov dword [rsp + 0x3c], r11d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r11d, dword [rsp + 0x3c]
jmp 0x4421cb
mov dword [r14 + 0x14c], eax
mov ecx, eax
call fcn.00440300
cdqe
mov qword [r14 + 0x88], rax
jmp 0x442202
mov dword [r14 + 0x14c], 6
mov ecx, 6
call fcn.00440300
cdqe
mov qword [r14 + 0x88], rax
jmp 0x442202
Function at 0x4422b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov r14, rcx
mov ecx, dword [rcx + 0x150]
cmp ecx, 0xffffffff
je 0x442403
mov rsi, qword [r14 + 0x180]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x442458
cmp rsi, 0xffffffffffffffff
je 0x442420
xor edx, edx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov r9d, 1
lea r8, [rsp + 0x48]
mov rcx, rax
lea rbp, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne al
movzx eax, al
mov dword [rsp + 0x3c], eax
xor ebx, ebx
xor r15d, r15d
lea r13, [rsp + 0x44]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x442361
cmp ebx, dword [r14 + 0x170]
jae 0x4423e0
cmp rsi, 0xffffffffffffffff
je 0x442379
mov eax, r15d
add rax, rsi
mov dword [rsp + 0x60], eax
sar rax, 0x20
mov dword [rsp + 0x64], eax
mov eax, ebx
mov r9, r13
mov rcx, rdi
shl rax, 4
add rax, qword [r14 + 0x178]
add ebx, 1
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], rbp
mov r8d, dword [rax]
call r12
mov r11d, dword [rsp + 0x44]
add r11d, r15d
test eax, eax
mov r15d, r11d
jne 0x442354
mov edx, dword [rsp + 0x3c]
xor ebx, ebx
test edx, edx
jne 0x442435
test r11d, r11d
jne 0x4423e8
test bl, bl
jne 0x4423e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14 + 0x14c], eax
mov ecx, eax
call fcn.00440300
cdqe
mov qword [r14 + 0x88], rax
jmp 0x4423f2
mov eax, dword [rsp + 0x3c]
test eax, eax
jne 0x442430
mov eax, r11d
mov qword [r14 + 0x88], rax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [r14 + 0x88], 0xfffffffffffff00d
mov dword [r14 + 0x14c], 6
jmp 0x4423f2
mov dword [rsp + 0x3c], 0
xor ebp, ebp
jmp 0x442341
mov ebx, 1
mov dword [rsp + 0x3c], r11d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r11d, dword [rsp + 0x3c]
jmp 0x4423b7
mov dword [r14 + 0x14c], 6
mov ecx, 6
call fcn.00440300
cdqe
mov qword [r14 + 0x88], rax
jmp 0x4423f2

Function at 0x442480
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x150]
call qword [sym.imp.msvcrt.dll__wrmdir]
cdqe
cmp rax, 0xffffffffffffffff
mov qword [rbx + 0x88], rax
je 0x4424b0
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [rbx + 0x14c], ecx
call fcn.00440300
cdqe
mov qword [rbx + 0x88], rax
add rsp, 0x20
pop rbx
ret

Function at 0x4426e0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x150]
call qword [sym.imp.msvcrt.dll__wmkdir]
cdqe
cmp rax, 0xffffffffffffffff
mov qword [rbx + 0x88], rax
je 0x442710
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [rbx + 0x14c], ecx
call fcn.00440300
cdqe
mov qword [rbx + 0x88], rax
add rsp, 0x20
pop rbx
ret
Function at 0x442740
Capabilities:
Create directory
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rcx, qword [rcx + 0x150]
call sub.msvcrt.dll_wcslen
cmp rax, 5
ja 0x442790
mov qword [rsi + 0x88], 0xfffffffffffff019
mov dword [rsi + 0x14c], 0x57
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsi + 0x150]
lea rbx, [rax + rax]
lea rdx, str.XXXXXX
mov r8d, 6
lea rbp, [r14 + rbx - 0xc]
mov rcx, rbp
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x442765
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4428d5
add rbx, r14
mov r12, qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov r14, qword [sym.imp.msvcrt.dll__wmkdir]
mov r15, qword [sym.imp.msvcrt.dll__errno]
lea r13, [rsp + 0x38]
mov edi, 0x7fff
mov r8, r13
mov edx, 8
mov rcx, qword [rsp + 0x30]
call r12
test eax, eax
je 0x4428f6
mov rcx, qword [rsp + 0x38]
lea r10, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
mov r8, rbp
movabs r9, 0x8421084210842109
mov rdx, rcx
add r8, 2
shr rdx, 1
mov rax, rdx
mul r9
shr rdx, 4
mov rax, rdx
shl rax, 5
sub rax, rdx
add rax, rax
sub rcx, rax
cmp r8, rbx
movzx eax, word [r10 + rcx*2]
mov rcx, rdx
mov word [r8 - 2], ax
jne 0x442832
mov qword [rsp + 0x38], rdx
mov rcx, qword [rsi + 0x150]
call r14
test eax, eax
je 0x442945
call r15
cmp dword [rax], 0x11
jne 0x442974
sub edi, 1
jne 0x442801
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x4429a0
mov qword [rsi + 0x88], 0xffffffffffffffff
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [rsi + 0x14c], ecx
call fcn.00440300
cdqe
mov qword [rsi + 0x88], rax
jmp 0x44277a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.00440300
cdqe
mov qword [rsi + 0x88], rax
jmp 0x44277a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.00440300
cdqe
mov qword [rsi + 0x88], rax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
jne 0x44277a
lea rdx, str.src_win_fs.c
lea rcx, str.released
mov r8d, 0x36d
call fcn.00472160
jmp 0x44277a
mov rbx, qword [rsi + 0x98]
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rcx, [rbx + rax - 6]
mov r8d, 6
mov rdx, rbp
call sub.msvcrt.dll_wcstombs
mov qword [rsi + 0x88], 0
jmp 0x442912
mov qword [rsi + 0x88], 0xffffffffffffffff
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [rsi + 0x14c], ecx
call fcn.00440300
cdqe
mov qword [rsi + 0x88], rax
jmp 0x442912
lea rdx, str.src_win_fs.c
lea rcx, str.released
mov r8d, 0x36d
call fcn.00472160
jmp 0x4428a9