joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012040
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov edx, pe_nt_image_headers64
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test ebx, ebx
je 0x1400120f3
lea rcx, [rsp + 0x48]
call fcn.140011c40
nop
mov ecx, 0x78
mov r9d, 0x38
cmp qword [rax], 0
cmove r9d, ecx
add r9, rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
lea r8d, [rcx - 0x75]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi + 8], rax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400120d5
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400120e5
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp qword [rdi + 8], 0xffffffffffffffff
jne 0x140012164
mov eax, 0xe0010006
jmp 0x140012166
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rbx + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x140012164
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x140012164
mov eax, 0xe0010005
jmp 0x140012166
xor eax, eax
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400121c0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
xor eax, eax
mov rbx, r9
mov dword [rsp + 0x40], eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400121f6
mov eax, dword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xe0010001
add rsp, 0x30
pop rbx
ret

Function at 0x140012210
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
xor eax, eax
mov rbx, r9
mov dword [rsp + 0x40], eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140012246
mov eax, dword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xe0010001
add rsp, 0x30
pop rbx
ret
Function at 0x140017e90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor edx, edx
mov rcx, qword [rcx + 0x1f60]
mov r8d, dword [rdi + 0x1f70]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rdi + 0x1f60]
lea r9, [rsp + 0x40]
mov r8d, 0xa10
lea rdx, [rdi + 0xc]
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
js 0x1400180ed
mov rcx, qword [rdi + 0x1f60]
lea r9, [rsp + 0x40]
mov r8d, 0x210
lea rdx, [rdi + 0xa1c]
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
js 0x1400180ed
mov rcx, qword [rdi + 0x1f60]
lea r9, [rsp + 0x40]
mov r8d, 0x330
lea rdx, [rdi + 0xc2c]
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
js 0x1400180ed
lea rdx, [rdi + 0xc]
mov eax, 0x7473754d
mov r8d, 0x142
nop word [rax + rax]
xor dword [rdx], eax
lea ecx, [rax + 1]
xor dword [rdx + 4], ecx
lea rdx, [rdx + 8]
add eax, 2
sub r8, 1
jne 0x140017f40
lea rdx, [rdi + 0xa1c]
mov r8d, 0x42
nop dword [rax]
nop word [rax + rax]
xor dword [rdx], eax
lea ecx, [rax + 1]
xor dword [rdx + 4], ecx
lea rdx, [rdx + 8]
add eax, 2
sub r8, 1
jne 0x140017f70
lea r9, [rdi + 0xc2c]
lea r10d, [r8 + 0x66]
xor dword [r9], eax
lea r8d, [rax + 1]
xor dword [r9 + 4], r8d
lea r9, [r9 + 8]
add eax, 2
sub r10, 1
jne 0x140017f90
cmp dword [rdi + 0xc], 0x7473754d
jne 0x1400180db
mov edx, 0xa10
lea rcx, [rdi + 0xc]
call fcn.14000a220
test eax, eax
jne 0x1400180db
xor ebx, ebx
cmp dword [rdi + 0xc28], 0x78747241
je 0x14001800b
mov edx, 0x210
mov dword [rdi + 0xc24], 1
lea rcx, [rdi + 0xa1c]
mov dword [rdi + 0xc28], 0x78747241
mov qword [rdi + 0xc1c], rbx
call fcn.14000a220
mov dword [rdi + 0xc20], eax
cmp dword [rdi + 0xc2c], 0x6e756e4d
mov qword [rsp + 0x50], r14
jne 0x1400180bb
cmp dword [rdi + 0xc30], 1
jne 0x1400180bb
mov edx, 0x330
lea rcx, [rdi + 0xc2c]
call fcn.14000a220
test eax, eax
jne 0x1400180bb
lea rsi, [rdi + 0xf5c]
lea r14, [rdi + 0xc38]
mov rcx, qword [rdi + 0x1f60]
xor edx, edx
mov r8d, dword [r14]
shl r8d, 0xc
add r8d, dword [rdi + 0x1f70]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rdi + 0x1f60]
lea r9, [rsp + 0x48]
mov r8d, 0x1000
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
js 0x1400180b4
cmp qword [rsp + 0x48], 0x1000
jne 0x1400180ad
inc rbx
add r14, 4
add rsi, 0x1000
cmp rbx, 1
jb 0x140018050
jmp 0x1400180c7
mov eax, 0xe0010001
jmp 0x1400180c3
mov eax, 0xe0010005
jmp 0x1400180c3
mov rcx, rdi
call fcn.140017d60
test eax, eax
js 0x1400180c9
xor eax, eax
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov eax, 0xe0010001
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x58]
mov eax, 0xe0010005
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018fd0
Capabilities:
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
push r14
sub rsp, 0xf0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
mov rbp, r8
mov rbx, rdx
mov r14, rcx
lea rax, vtable.XFileIO.0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0xffffffffffffffff
mov edx, pe_nt_image_headers64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x60]
call fcn.140011c40
nop
mov ecx, 0x78
mov r9d, 0x38
cmp qword [rax], 0
cmove r9d, ecx
add r9, rax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
lea r8d, [rcx - 0x75]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140019086
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140019099
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp rbx, 0xffffffffffffffff
jne 0x1400190a6
mov edi, 0xe0010006
jmp 0x1400190e2
xor r9d, r9d
xor r8d, r8d
mov edx, dword [r14 + 0x1f70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400190e2
mov edi, 0xe0010001
cmp rbx, 0xffffffffffffffff
je 0x1400190f2
mov rcx, rbx
call qword [0x1400472c0]
nop
mov eax, edi
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14001c7d0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov r10, qword [0x140063e00]
test r10, r10
je 0x14001c81f
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14001c7f0
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [r10 + 0x70]
lea r8d, [rax*2 + 2]
lea r9, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x38
ret
Function at 0x14001cc60
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
je 0x14001ccc6
nop dword [rax]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14001ccb1
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x420
je 0x14001ccc6
cmp eax, 0x10
jne 0x14001ccb1
mov rdx, rbx
mov rcx, rdi
call fcn.14001c830
jmp 0x14001cc80
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001d230
Capabilities:
Delete file
Set file attributes
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rbp], rax
mov rdi, r8
mov r15, rdx
mov r14, rcx
xor r12d, r12d
mov esi, r12d
nop dword [rax]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14001d408
lea edx, [rax + 2]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x14001d2c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001d3cc
mov dword [rbp - 8], 0
mov word [rbp - 4], 0x100
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x14001d318
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001d3cc
mov byte [rsp + 0x70], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x5c], xmm0
mov qword [rbp - 0x48], 5
mov dword [rbp - 0x64], 2
mov dword [rbp - 0x68], 0x1f01ff
mov dword [rbp - 0x60], r12d
mov dword [rbp - 0x4c], r12d
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x60], r12
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea ecx, [r8 + 1]
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x14001d3c2
mov byte [rbp - 0x80], al
lea rax, [rsp + 0x60]
mov qword [rbp - 0x78], rax
xor r9d, r9d
mov r8, qword [rsp + 0x60]
lea edx, [r9 + 1]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x14001d3b1
lea r8, [rbp - 0x30]
mov edx, 4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x14001d3b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rcx, [rbp - 0x78]
call fcn.14001dd80
nop
lea rcx, [rsp + 0x78]
call fcn.14001dda0
mov edx, pe_nt_image_headers64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x14001d270
mov ecx, 0xdeaddead
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14001d42e
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x70]
mov r8d, r15d
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [0x1400472c0]
mov eax, 1
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14002fb30
add rsp, 0x110
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001fde0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push rdi
sub rsp, 0x280
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x298], rbx
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0x2b]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
mov dword [rsp + 0x30], 1
mov r8, qword [0x140063e00]
add r8, 0x10
cmp qword [r8 + 0x18], 8
jb 0x14001fe61
mov r8, qword [r8]
mov eax, 0x58
mov word [rsp + 0x48], ax
mov eax, 0x66
mov word [rsp + 0x4a], ax
mov eax, 0x6d
mov word [rsp + 0x4c], ax
mov word [rsp + 0x4e], ax
mov eax, 0x63
mov word [rsp + 0x50], ax
mov eax, 0x6a
mov word [rsp + 0x52], ax
mov eax, 0x62
mov word [rsp + 0x54], ax
mov eax, 0x2f
mov word [rsp + 0x56], ax
mov eax, 0x64
mov word [rsp + 0x58], ax
mov eax, 0x70
mov word [rsp + 0x5a], ax
mov eax, 0x6e
mov word [rsp + 0x5c], ax
mov word [rsp + 0x5e], bx
movzx eax, word [rsp + 0x48]
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [rsp + rbx*2 + 0x48]
dec edx
mov word [rsp + rbx*2 + 0x48], dx
inc rbx
cmp rbx, 0xb
jb 0x14001fee0
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
lea rdx, str._ls_ls_ls.exe
mov rcx, rdi
call fcn.140021a20
mov rax, rdi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14002fb30
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret
Function at 0x140020300
Capabilities:
Encode data using xor
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 8]
call fcn.14000c760
test rax, rax
je 0x14002040f
mov edx, dword [rdx]
lea r8, [rsp + 0x50]
mov rcx, rax
call fcn.14000cfa0
test eax, eax
jns 0x14002040f
mov dword [rsp + 0x38], 0x62b6
mov eax, dword [rsp + 0x38]
xor eax, 0x2e
mov word [rsp + 0x3c], ax
mov eax, dword [rsp + 0x38]
inc ax
xor eax, 0x35
mov word [rsp + 0x3e], ax
mov eax, dword [rsp + 0x38]
add ax, 2
xor eax, 0x4f
mov word [rsp + 0x40], ax
mov eax, dword [rsp + 0x38]
add ax, 3
xor eax, 0x31
mov word [rsp + 0x42], ax
xor eax, eax
xor r9d, r9d
mov word [rsp + 0x44], ax
movzx eax, word [rsp + 0x3c]
mov edx, r9d
movzx eax, word [rsp + rdx*2 + 0x3c]
mov ecx, dword [rsp + 0x38]
add ecx, edx
xor ecx, eax
mov word [rsp + rdx*2 + 0x3c], cx
inc rdx
cmp rdx, 4
jb 0x1400203a3
mov rcx, qword [0x140063e00]
mov word [rsp + 0x44], r9w
test rcx, rcx
je 0x140020455
lea rdx, [rsp + 0x3c]
mov rax, 0xffffffffffffffff
cmp word [rdx + rax*2 + 2], r9w
lea rax, [rax + 1]
jne 0x1400203e0
mov rcx, qword [rcx + 0x70]
lea r8d, [rax*2 + 2]
mov qword [rsp + 0x20], r9
lea rdx, [rsp + 0x3c]
lea r9, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140020455
cmp qword [rbx + 0x28], 8
lea rdx, [rbx + 0x10]
jb 0x14002041d
mov rdx, qword [rdx]
lea rcx, [rsp + 0x50]
call fcn.140033e14
test eax, eax
jne 0x140020455
mov r8d, dword [rdi]
lea ecx, [rax + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140020455
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [0x1400472c0]
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14002fb30
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x140020560
Capabilities:
Query service status
Stop service

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, rcx
xor esi, esi
mov ebx, esi
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400205c1
cmp dword [rsp + 0x5c], 1
je 0x1400206fc
lea r8, [rsp + 0x58]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x96
jl 0x140020591
call fcn.14000d2c0
mov rbx, rax
test rax, rax
je 0x1400206fc
lea rax, vtable.ServiceKiller.0
mov qword [rsp + 0x28], rax
movdqa xmm0, xmmword [0x140054e40]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], si
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x58]
call fcn.14001fde0
mov rdi, rax
lea rax, [rsp + 0x38]
cmp rax, rdi
je 0x14002064c
lea rcx, [rsp + 0x38]
call fcn.14000a390
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x14002068f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020689
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020724
call fcn.14002fb54
nop
mov rcx, rbx
call fcn.14000c760
test rax, rax
je 0x1400206a9
lea r9, [rsp + 0x28]
mov rdx, rax
call fcn.14000ce10
mov rcx, rbx
call fcn.14000c760
test rax, rax
je 0x1400206be
mov rcx, rax
call fcn.14000d260
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x1400206fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400206f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002071e
call fcn.14002fb54
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14002fb30
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140036ad4
nop
call fcn.140036ad4
nop
int3
Function at 0x140020b90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x4d0], rbx
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov rbx, rdx
lea r8, [0x140054cf0]
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.1400370b0
cmp qword [rsp + 0x38], 0
jne 0x140020c81
mov eax, 0x3b
mov word [rbp - 0x80], ax
mov eax, 0x53
mov word [rbp - 0x7e], ax
mov eax, 0x83
mov word [rbp - 0x7c], ax
mov eax, 0x61
mov word [rbp - 0x7a], ax
xor ebx, ebx
mov word [rbp - 0x78], bx
movzx eax, word [rbp - 0x80]
mov edx, ebx
nop word [rax + rax]
movzx ecx, word [rbp + rdx*2 - 0x80]
sub ecx, 0xd
mov word [rbp + rdx*2 - 0x80], cx
inc rdx
cmp rdx, 4
jb 0x140020c20
mov rcx, qword [0x140063e00]
test rcx, rcx
je 0x140020c7a
lea rdx, [rbp - 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rdx + rax*2], bx
jne 0x140020c50
lea r8d, [rax*2 + 2]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea rdx, [rbp - 0x80]
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x140020db3
lea rax, [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x60], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x30], 1
lea r8, [0x140054cf0]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400370b0
mov r9, qword [rsp + 0x40]
test r9, r9
jne 0x140020d14
mov eax, 0x38
mov word [rbp - 0x70], ax
mov eax, 0x53
mov word [rbp - 0x6e], ax
mov eax, pe_nt_image_headers64
mov word [rbp - 0x6c], ax
mov eax, 0x3b
mov word [rbp - 0x6a], ax
xor ebx, ebx
mov word [rbp - 0x68], bx
movzx eax, word [rbp - 0x70]
mov edx, ebx
nop dword [rax]
movzx ecx, word [rbp + rdx*2 - 0x70]
sub ecx, 0xa
mov word [rbp + rdx*2 - 0x70], cx
inc rdx
cmp rdx, 4
jb 0x140020cf0
lea rcx, [rbp - 0x70]
call fcn.14001c7d0
jmp 0x140020da7
mov byte [rsp + 0x50], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov edx, 1
mov r8d, 0x200
lea rcx, [rbp - 0x60]
call fcn.1400381ac
mov rbx, rax
test rax, rax
je 0x140020d97
nop
mov r9, qword [rsp + 0x38]
mov edx, 1
mov r8d, 0x200
lea rcx, [rbp + 0x1a0]
call fcn.1400381ac
cmp rbx, rax
jne 0x140020dd3
mov r8, rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x60]
call fcn.140031d10
test eax, eax
jne 0x140020dd3
mov r9, qword [rsp + 0x40]
lea edx, [rax + 1]
mov r8d, 0x200
lea rcx, [rbp - 0x60]
call fcn.1400381ac
mov rbx, rax
test rax, rax
jne 0x140020d40
mov ebx, 1
lea rcx, [rsp + 0x58]
call fcn.140021a70
nop
lea rcx, [rsp + 0x68]
call fcn.140021a70
mov eax, ebx
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.14002fb30
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4b0
pop rbp
ret
xor ebx, ebx
jmp 0x140020d9c
Function at 0x140022650
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x118
call fcn.140031700
xor ebx, ebx
mov dword [rsp + 0x50], 0x11c
cmp qword [0x140063f58], rbx
jne 0x140022783
mov dword [rsp + 0x20], 0x9c20
mov eax, dword [rsp + 0x20]
xor eax, 0x6e
mov word [rsp + 0x24], ax
mov eax, dword [rsp + 0x20]
inc ax
xor eax, 0x74
mov word [rsp + 0x26], ax
mov eax, dword [rsp + 0x20]
add ax, 2
xor eax, 0x64
mov word [rsp + 0x28], ax
mov eax, dword [rsp + 0x20]
add ax, 3
xor eax, 0x6c
mov word [rsp + 0x2a], ax
mov eax, dword [rsp + 0x20]
add ax, 4
xor eax, 0x6c
mov word [rsp + 0x2c], ax
mov eax, dword [rsp + 0x20]
add ax, 5
xor eax, 0x2e
mov word [rsp + 0x2e], ax
mov eax, dword [rsp + 0x20]
add ax, 6
xor eax, 0x64
mov word [rsp + 0x30], ax
mov eax, dword [rsp + 0x20]
add ax, 7
xor eax, 0x6c
mov word [rsp + 0x32], ax
mov eax, dword [rsp + 0x20]
add ax, 8
xor eax, 0x6c
mov word [rsp + 0x34], ax
xor eax, eax
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x24]
mov eax, ebx
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x24]
mov edx, dword [rsp + 0x20]
add edx, eax
xor edx, ecx
mov word [rsp + rax*2 + 0x24], dx
inc rax
cmp rax, 9
jb 0x140022740
lea rcx, [rsp + 0x24]
mov word [rsp + 0x36], bx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140063f58], rax
test rax, rax
jne 0x140022783
mov rax, qword [0x140063f68]
jmp 0x14002282b
mov rax, qword [0x140063f68]
test rax, rax
jne 0x140022830
mov dword [rsp + 0x38], 0x5a
mov byte [rsp + 0x3c], 8
mov byte [rsp + 0x3d], 0x2e
mov byte [rsp + 0x3e], 0x36
mov byte [rsp + 0x3f], 0x1d
mov byte [rsp + 0x40], 0x3f
mov byte [rsp + 0x41], 0x2e
mov byte [rsp + 0x42], 0xc
mov byte [rsp + 0x43], 0x3f
mov byte [rsp + 0x44], 0x28
mov byte [rsp + 0x45], 0x29
mov byte [rsp + 0x46], 0x33
mov byte [rsp + 0x47], 0x35
mov byte [rsp + 0x48], 0x34
mov byte [rsp + 0x49], al
movzx eax, byte [rsp + 0x3c]
nop word [rax + rax]
movsx edx, byte [rsp + rbx + 0x3c]
mov eax, dword [rsp + 0x38]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rsp + rbx + 0x3c], al
inc rbx
cmp rbx, 0xd
jb 0x1400227f0
mov rcx, qword [0x140063f58]
lea rdx, [rsp + 0x3c]
mov byte [rsp + 0x49], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140063f68], rax
test rax, rax
je 0x140022846
lea rcx, [rsp + 0x50]
call rax
test eax, eax
jne 0x140022846
cmp dword [rsp + 0x54], 0xa
jb 0x140022846
mov al, 1
jmp 0x140022848
xor al, al
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14002fb30
mov rbx, qword [rsp + 0x190]
add rsp, 0x180
pop rbp
ret
Function at 0x140022870
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x670
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov r9, rcx
lea r8, str.._s
lea rcx, [rsp + 0x5c0]
mov edx, 0xa0
call fcn.14000b530
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x5c0]
mov dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140022985
mov eax, dword [0x140063f60]
mov dword [rsp + 0x50], 0x270
mov dword [rsp + 0x54], 0x345821ab
mov dword [rsp + 0x5c], 0x306
test eax, eax
jne 0x14002290e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
imul eax, eax, 0x343fd
lea r9, [rsp + 0x40]
mov r8d, 0x270
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
mov rcx, rbx
add eax, 0x269ec3
sar eax, 0x10
and eax, 0x7fff
mov dword [0x140063f60], eax
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002297c
mov eax, dword [rsp + 0x58]
not eax
cmp dword [rsp + 0x2c8], eax
jne 0x14002297c
cmp dword [rsp + 0x2cc], 0
jl 0x14002297c
mov rax, rbx
jmp 0x14002298c
mov rcx, rbx
call qword [0x1400472c0]
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.14002fb30
add rsp, 0x670
pop rbx
ret