joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fcae
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov eax, dword [rcx + 8]
test eax, eax
jne 0x14000fccc
mov rcx, rsi
call fcn.14000f781
mov eax, dword [rsi + 8]
cmp eax, 2
je 0x14000fcf3
cmp eax, 1
jne 0x14000fd63
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14005fab8
mov r9, qword [rsi]
test r9, r9
jne 0x14000fd17
lea rcx, str.ctx__lgfp
lea rdx, str..._logging.c
mov r8d, 0x2f
call fcn.140088ff4
mov r9, qword [rsi]
mov rcx, qword [rdi]
mov r8, qword [rdi + 8]
mov edx, 1
call fcn.14008bb5c
cmp rax, qword [rdi + 8]
jae 0x14000fd63
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000fd42
call fcn.14008b1fc
mov qword [rsi], 0
mov dword [rsi + 8], 3
mov rcx, qword [rsi + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, str.Disabled_writing_session_log_due_to_error_while_writing
add rsp, 0x28
pop rdi
pop rsi
jmp rax
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140014be5
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx]
cmp rax, qword [rdx]
je 0x140014c19
lea rcx, str.x0__nw__x1__nw
lea rdx, str..._mpint.c
mov r8d, 0x92
call fcn.140088ff4
mov rax, qword [rdi]
and ebx, 1
neg rbx
mov qword [rsp + 0x28], rbx
test rax, rax
je 0x140014c5b
xor eax, eax
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
mov rdx, qword [rdx + rax*8]
xor rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x28]
and rcx, rdx
mov rdx, qword [rdi + 8]
xor qword [rdx + rax*8], rcx
mov rdx, qword [rsi + 8]
xor qword [rdx + rax*8], rcx
inc rax
cmp rax, qword [rdi]
jb 0x140014c2b
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140014f30
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov rax, qword [rcx + 8]
mov rcx, rax
shr rcx, 0x3e
je 0x140014f66
lea rcx, str.hex.len_____size_t_0____4
lea rdx, str..._mpint.c
mov r8d, 0xf2
call fcn.140088ff4
mov rax, qword [r14 + 8]
lea rcx, [rax*4 + 0x3f]
shr rcx, 6
mov eax, 1
cmp rcx, rax
cmovbe rcx, rax
call fcn.140014a2d
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x140015011
mov r8, 0xffffffffffffffff
xor r9d, r9d
xor r10d, r10d
add rcx, qword [r14]
movsx ecx, byte [r8 + rcx]
movsxd rcx, ecx
lea rbx, [rcx - 0x61]
mov edx, 0x66
sub rdx, rcx
or rdx, rbx
sar rdx, 0x3f
lea rsi, [rcx - 0x41]
mov ebx, 0x46
sub rbx, rcx
or rbx, rsi
sar rbx, 0x3f
lea esi, [rcx - 0x30]
lea edi, [rcx - 0x57]
xor esi, edi
and edx, esi
add ecx, 0xffffffc9
xor edi, ecx
xor edi, edx
and ebx, edi
xor ebx, ecx
and ebx, 0xf
mov rdx, r10
shr rdx, 4
mov ecx, r9d
and cl, 0x3c
shl rbx, cl
mov rcx, qword [rax + 8]
or qword [rcx + rdx*8], rbx
inc r10
mov rcx, qword [r14 + 8]
dec r8
add r9, 4
cmp r10, rcx
jb 0x140014f9d
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14001511c
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov r8, qword [rcx]
test r8, r8
je 0x140015180
mov r9, qword [rcx + 8]
mov rax, 0xffffffffffffffff
xor ecx, ecx
mov rdi, 0xffffffffffffffff
mov r10, rdi
mov r11, rax
mov rdi, qword [r9 + rcx*8]
mov rax, rdi
shr rax, 1
mov esi, edi
and esi, 1
or rsi, rax
neg rsi
xor rdi, r10
sar rsi, 0x3f
and rdi, rsi
xor rdi, r10
mov rax, rcx
xor rax, r11
and rax, rsi
xor rax, r11
inc rcx
cmp r8, rcx
jne 0x14001513a
shl rax, 6
or rax, 1
jmp 0x14001518e
mov rdi, 0xffffffffffffffff
mov rax, 0xffffffffffffffc1
mov ecx, 0x20
xor r8d, r8d
mov rdx, rdi
shr rdx, cl
mov rsi, rdx
neg rsi
xor rdx, rdi
sar rsi, 0x3f
and rdx, rsi
xor rdi, rdx
and rsi, rcx
add r8, rsi
shr rcx, 1
jne 0x140015196
add rax, r8
pop rdi
pop rsi
ret

Function at 0x14001532c
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r9, rcx
test r8, r8
je 0x14001535c
lea rax, [r8 - 1]
movzx ecx, byte [r9 + rax]
xor rcx, 0x30
dec rcx
sar rcx, 0x3f
xor r8, rax
and r8, rcx
xor r8, rax
add rax, 0xffffffffffffffff
jb 0x14001533b
jmp 0x14001535f
xor r8d, r8d
test rdx, rdx
je 0x1400153b6
xor ecx, ecx
mov r10, r8
shr r10, cl
mov edi, 1
shl rdi, cl
cmp rdi, rdx
jae 0x1400153a8
and r10b, 1
neg r10b
mov r11, rdx
sub r11, rdi
add rdi, r9
xor esi, esi
mov bl, byte [r9 + rsi]
mov al, byte [rdi + rsi]
xor al, bl
and al, r10b
xor bl, al
mov byte [r9 + rsi], bl
xor byte [rdi + rsi], al
inc rsi
cmp r11, rsi
jne 0x14001538b
inc rcx
mov rax, rdx
shr rax, cl
test rax, rax
jne 0x140015366
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400341e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov byte [rsp + 0x28], 0x6b
mov byte [rsp + 0x29], 0x65
mov byte [rsp + 0x2a], 0x72
mov byte [rsp + 0x2b], 0x6e
mov byte [rsp + 0x2c], 0x65
mov byte [rsp + 0x2d], 0x6c
mov byte [rsp + 0x2e], 0x33
mov byte [rsp + 0x2f], 0x32
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x38], 0x4c
mov byte [rsp + 0x39], 0x6f
mov byte [rsp + 0x3a], 0x61
mov byte [rsp + 0x3b], 0x64
mov byte [rsp + 0x3c], 0x4c
mov byte [rsp + 0x3d], 0x69
mov byte [rsp + 0x3e], 0x62
mov byte [rsp + 0x3f], 0x72
mov byte [rsp + 0x40], 0x61
mov byte [rsp + 0x41], 0x72
mov byte [rsp + 0x42], 0x79
mov byte [rsp + 0x43], 0x41
mov byte [rsp + 0x44], 0
mov byte [rsp + 0x58], 0x4c
mov byte [rsp + 0x59], 0x6f
mov byte [rsp + 0x5a], 0x61
mov byte [rsp + 0x5b], 0x64
mov byte [rsp + 0x5c], 0x4c
mov byte [rsp + 0x5d], 0x69
mov byte [rsp + 0x5e], 0x62
mov byte [rsp + 0x5f], 0x72
mov byte [rsp + 0x60], 0x61
mov byte [rsp + 0x61], 0x72
mov byte [rsp + 0x62], 0x79
mov byte [rsp + 0x63], 0x45
mov byte [rsp + 0x64], pe_nt_image_headers64
mov byte [rsp + 0x65], 0x41
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x48], 0x56
mov byte [rsp + 0x49], 0x69
mov byte [rsp + 0x4a], 0x72
mov byte [rsp + 0x4b], 0x74
mov byte [rsp + 0x4c], 0x75
mov byte [rsp + 0x4d], 0x61
mov byte [rsp + 0x4e], 0x6c
mov byte [rsp + 0x4f], 0x41
mov byte [rsp + 0x50], 0x6c
mov byte [rsp + 0x51], 0x6c
mov byte [rsp + 0x52], 0x6f
mov byte [rsp + 0x53], 0x63
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x68], 0x56
mov byte [rsp + 0x69], 0x69
mov byte [rsp + 0x6a], 0x72
mov byte [rsp + 0x6b], 0x74
mov byte [rsp + 0x6c], 0x75
mov byte [rsp + 0x6d], 0x61
mov byte [rsp + 0x6e], 0x6c
mov byte [rsp + 0x6f], 0x50
mov byte [rsp + 0x70], 0x72
mov byte [rsp + 0x71], 0x6f
mov byte [rsp + 0x72], 0x74
mov byte [rsp + 0x73], 0x65
mov byte [rsp + 0x74], 0x63
mov byte [rsp + 0x75], 0x74
mov byte [rsp + 0x76], 0
lea rcx, [rsp + 0x28]
mov rax, qword [rsp + 0x90]
call qword [rax]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x90]
call qword [rax + 8]
mov rcx, qword [rsp + 0x90]
mov qword [rcx + 0x10], rax
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x90]
call qword [rax + 8]
mov rcx, qword [rsp + 0x90]
mov qword [rcx + 0x18], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x90]
call qword [rax + 8]
mov rcx, qword [rsp + 0x90]
mov qword [rcx + 0x20], rax
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x90]
call qword [rax + 8]
mov rcx, qword [rsp + 0x90]
mov qword [rcx + 0x28], rax
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 9
rep stosb byte [rdi], al
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0xd
rep stosb byte [rdi], al
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0xf
rep stosb byte [rdi], al
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0xd
rep stosb byte [rdi], al
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xf
rep stosb byte [rdi], al
add rsp, 0x80
pop rdi
ret
Function at 0x1400346a9
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x18]
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 6]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 8]
dec rax
mov qword [rsp + 8], rax
cmp qword [rsp + 0x20], 0
je 0x140034792
mov rax, qword [rsp]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp]
mov eax, dword [rax + 0x10]
mov qword [rsp + 0x18], rax
mov rdi, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp]
mov eax, dword [rax + 0x24]
and eax, 0x20000000
cmp eax, 0x20000000
jne 0x140034781
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x10]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x18]
mov dword [rax], ecx
mov rax, qword [rsp]
add rax, 0x28
mov qword [rsp], rax
jmp 0x1400346e8
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x14005f8fc
Capabilities:
Encode data using base64

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor eax, eax
movsx r8d, byte [rcx + rax]
lea esi, [r8 - 0x41]
cmp sil, 0x19
ja 0x14005f927
add r8d, 0xffffffbf
jmp 0x14005f973
lea esi, [r8 - 0x61]
cmp sil, 0x19
ja 0x14005f937
add r8d, 0xffffffb9
jmp 0x14005f973
lea esi, [r8 - 0x30]
cmp sil, 9
ja 0x14005f947
add r8d, 4
jmp 0x14005f973
cmp r8b, 0x2b
je 0x14005f965
cmp r8b, 0x3d
je 0x14005f96d
cmp r8b, 0x2f
jne 0x14005fa15
mov r8d, 0x3f
jmp 0x14005f973
mov r8d, 0x3e
jmp 0x14005f973
mov r8d, 0xffffffff
mov dword [rsp + rax*4 + 0x20], r8d
inc rax
cmp rax, 4
jne 0x14005f912
mov eax, dword [rsp + 0x20]
xor esi, esi
cmp eax, 0xffffffff
je 0x14005fa17
mov ecx, dword [rsp + 0x24]
cmp ecx, 0xffffffff
je 0x14005fa17
mov r8d, dword [rsp + 0x28]
mov r9d, dword [rsp + 0x2c]
cmp r8d, 0xffffffff
je 0x14005f9bd
mov r10d, 3
cmp r9d, 0xffffffff
jne 0x14005f9cf
mov r10d, 2
jmp 0x14005f9c9
cmp r9d, 0xffffffff
jne 0x14005fa17
mov r10d, 1
mov r9d, 0xffffffff
shl eax, 0x12
shl ecx, 0xc
or eax, ecx
shr eax, 0x10
mov byte [rdx], al
mov esi, 1
cmp r10d, 2
jb 0x14005fa17
shl r8d, 6
mov eax, r8d
and eax, 0xf00
or eax, ecx
mov byte [rdx + 1], ah
mov esi, 2
cmp r10d, 3
jne 0x14005fa17
and r9d, 0x3f
or r9d, r8d
mov byte [rdx + 2], r9b
mov esi, 3
jmp 0x14005fa17
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007d5e0
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x140065994
Capabilities:
Hide graphical window

Disassembly:
push rsi
sub rsp, 0x30
mov rcx, qword [0x1400cd030]
mov qword [rsp + 0x20], 0
lea r9, [fcn.14000ecbb]
mov edx, 0x6f
xor r8d, r8d
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rcx, rsi
add rsp, 0x30
pop rsi
jmp qword [sym.imp.USER32.dll_DestroyWindow]

Function at 0x140066646
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x28
mov r8, rcx
mov rcx, qword [0x1400cd078]
test rcx, rcx
jne 0x140066697
mov rcx, qword [0x1400cd030]
mov qword [rsp + 0x20], 0
lea r9, [0x1400666a2]
mov edx, 0x6e
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov qword [0x1400cd078], rax
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400cd078]
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_SetActiveWindow]
Function at 0x140067164
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rdi
sub rsp, 0xc8
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
cmp dword [0x1400cb958], 0
je 0x14006719b
xor esi, esi
cmp qword [0x1400cb940], 0
setne sil
jmp 0x14006730b
lea rdi, [rsp + 0x2c]
xor esi, esi
mov r8d, 0x90
mov rcx, rdi
xor edx, edx
call fcn.14007eb10
mov dword [rdi - 4], 0x94
lea rdi, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [rdi + 0x10], 2
sete al
mov dword [0x1400cb95c], eax
lea rcx, str.USER32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400672d0
mov rdi, rax
lea rdx, [0x1400b0d16]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cb920], rax
test rax, rax
je 0x1400672d0
lea rdx, str.MonitorFromWindow
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cb928], rax
test rax, rax
je 0x1400672d0
lea rdx, str.MonitorFromRect
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cb930], rax
test rax, rax
je 0x1400672d0
lea rdx, str.MonitorFromPoint
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cb938], rax
test rax, rax
je 0x1400672d0
lea rdx, str.EnumDisplayMonitors
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cb948], rax
test rax, rax
je 0x1400672d0
lea rdx, str.GetMonitorInfoA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cb940], rax
test rax, rax
je 0x1400672d0
lea rdx, str.EnumDisplayDevicesA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cb950], rax
test rax, rax
je 0x1400672d0
mov dword [0x1400cb958], 1
mov esi, 1
jmp 0x14006730b
mov qword [0x1400cb920], rsi
mov qword [0x1400cb928], rsi
mov qword [0x1400cb930], rsi
mov qword [0x1400cb938], rsi
mov qword [0x1400cb940], rsi
mov qword [0x1400cb948], rsi
mov qword [0x1400cb950], rsi
mov dword [0x1400cb958], 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14007d5e0
mov eax, esi
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x14006ca04
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp ecx, 2
jne 0x14006cac9
mov r14d, r9d
mov ebx, r8d
mov rdi, rdx
lea eax, [rbx + 1]
movsxd rdx, eax
mov ecx, 0x2002
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
je 0x14006cac9
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14006cac9
mov rbp, rax
movsxd rbx, ebx
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call fcn.14007e6c0
xor eax, eax
mov byte [rbp + rbx], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test r14b, r14b
jne 0x14006ca8e
mov rcx, qword [0x1400cd038]
mov r8d, 1
mov edx, 0x8002
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x1400cd038]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14006cabb
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, 1
mov rdx, rsi
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x14006cac4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test r14b, r14b
je 0x14006cad4
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [0x1400cd038]
mov edx, 0x8002
xor r8d, r8d
xor r9d, r9d
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.USER32.dll_SendMessageA]

Function at 0x1400727be
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp byte [0x1400cdd80], 0
je 0x1400727d4
add rsp, 0x28
pop rdi
pop rsi
ret
mov byte [0x1400cdd80], 1
lea rcx, str.hhctrl.ocx
call fcn.140073bf6
mov rsi, rax
test rax, rax
je 0x140072863
lea rdx, str.HtmlHelpA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cdd88], rax
test rax, rax
je 0x14007286e
cmp byte [0x1400cdda9], 0
jne 0x14007287e
mov byte [0x1400cdda9], 1
call fcn.140072778
test eax, eax
je 0x14007287e
mov rdx, qword [0x1400cdd78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x1400cddac], eax
test eax, eax
je 0x14007287e
mov rdx, qword [0x1400cdd78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14007287e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x1400cdda0], rax
jmp 0x140072885
mov qword [0x1400cdd88], 0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1400cdda0]
test rax, rax
jne 0x1400727cd
xor esi, esi
lea rdi, str.n__v_
mov rdx, qword [rdi + rsi*8]
mov rcx, 0xffffffff80000002
xor r8d, r8d
call fcn.1400741fa
test rax, rax
jne 0x1400728be
test rsi, rsi
mov esi, 1
je 0x140072897
jmp 0x1400727cd
mov qword [0x1400cdd90], rax
mov byte [0x1400cdd98], 0
jmp 0x1400727cd
Function at 0x1400728d1
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1400cdd90]
test rcx, rcx
je 0x140072913
cmp byte [0x1400cdd98], 1
jne 0x140072915
xor ecx, ecx
xor edx, edx
mov r8d, 0x12
xor r9d, r9d
call qword [0x1400cdd88]
mov rcx, qword [0x1400cdd90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [0x1400cdd90]
jmp 0x140072915
xor ecx, ecx
call fcn.1400118b0
mov qword [0x1400cdd90], 0
mov byte [0x1400cdd98], 0
add rsp, 0x28
ret
Function at 0x140072943
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov r15, rdx
mov r13, rcx
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdx, qword [0x1400cdd90]
test rdx, rdx
jne 0x140072a25
cmp qword [0x1400cdda0], 0
je 0x140072a25
cmp byte [0x1400cddb0], 0
jne 0x140072a14
mov byte [0x1400cddb0], 1
lea rdx, [rsp + 0x50]
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140072a14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
lea rcx, str._sputty__lu__llu.chm
lea rdx, [rsp + 0x50]
mov r8d, eax
xor r9d, r9d
call fcn.14005f1b3
mov rbx, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
mov rcx, rax
mov edx, 0x40000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140072a98
mov rsi, rax
jmp 0x140072b1f
xor ebx, ebx
mov rcx, rbx
call fcn.1400118b0
mov rdx, qword [0x1400cdd90]
test rdx, rdx
je 0x140072a73
test r15, r15
je 0x140072a5d
lea rcx, str._s::__s.html_main
mov r8, r15
call fcn.14005f1b3
mov rsi, rax
mov rcx, r13
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
call qword [0x1400cdd88]
mov rcx, rsi
call fcn.1400118b0
jmp 0x140072a6c
mov rcx, r13
xor r8d, r8d
xor r9d, r9d
call qword [0x1400cdd88]
mov byte [0x1400cdda8], 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14007d5e0
nop
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x40], r13
mov edi, 1
mov r14, qword [sym.imp.KERNEL32.dll_GetLastError]
lea r13, [rsp + 0x50]
mov r12, qword [sym.imp.KERNEL32.dll_CreateFileA]
call r14
cmp eax, 0x50
jne 0x140072bb5
mov rcx, rbx
call fcn.1400118b0
lea rcx, str._sputty__lu__llu.chm
mov rdx, r13
mov r8d, ebp
mov r9, rdi
call fcn.14005f1b3
mov rbx, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
mov rcx, rax
mov edx, 0x40000000
mov r8d, 1
xor r9d, r9d
call r12
inc rdi
cmp rax, 0xffffffffffffffff
je 0x140072ab5
mov rsi, rax
mov r13, qword [rsp + 0x40]
mov r8d, dword [0x1400cddac]
test r8d, r8d
je 0x140072b7a
mov rbp, qword [0x1400cdda0]
xor edi, edi
lea r14, [rsp + 0x4c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
sub r8d, edi
mov dword [rsp + 0x4c], 0
mov edx, edi
add rdx, rbp
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov r9, r14
call r12
test eax, eax
je 0x140072b8c
mov eax, dword [rsp + 0x4c]
add edi, eax
inc edi
mov r8d, dword [0x1400cddac]
cmp r8d, edi
ja 0x140072b40
mov qword [0x1400cdd90], rbx
mov byte [0x1400cdd98], 1
xor ebx, ebx
jmp 0x140072b95
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbx
call fcn.1400118b0
cmp rsi, 0xffffffffffffffff
je 0x140072a1e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140072a1e
mov r13, qword [rsp + 0x40]
jmp 0x140072a16
Function at 0x140072bbf
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
cmp byte [0x1400cdda8], 1
jne 0x140072bdf
xor ecx, ecx
xor edx, edx
mov r8d, 0x12
xor r9d, r9d
call qword [0x1400cdd88]
mov rcx, qword [0x1400cdd90]
test rcx, rcx
je 0x140072bff
cmp byte [0x1400cdd98], 1
jne 0x140072bff
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
add rsp, 0x28
ret

Function at 0x140073abb
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [0x1400ce5e8], 0
je 0x140073ae2
mov rsi, qword [0x1400ce5e0]
jmp 0x140073b27
lea rcx, str.secur32.dll
call fcn.140073bf6
mov rsi, rax
lea rcx, str.sspicli.dll
call fcn.140073bf6
test rsi, rsi
je 0x140073b17
lea rdx, str.GetUserNameExA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
jmp 0x140073b19
xor esi, esi
mov qword [0x1400ce5e0], rsi
mov byte [0x1400ce5e8], 1
test rsi, rsi
je 0x140073b89
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, 8
xor edx, edx
mov r8, rdi
call rsi
mov ecx, dword [rdi]
mov edx, 1
xor r8d, r8d
call fcn.140011830
mov rsi, rax
mov ecx, 8
mov rdx, rax
mov r8, rdi
call qword [0x1400ce5e0]
test al, al
je 0x140073b81
mov rcx, rsi
mov edx, 0x40
call fcn.14007ecb0
test rax, rax
je 0x140073bdf
mov byte [rax], 0
jmp 0x140073bdf
mov rcx, rsi
call fcn.1400118b0
lea rdx, [rsp + 0x2c]
mov dword [rdx], 0
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140073ba6
mov ecx, dword [rsp + 0x2c]
jmp 0x140073bb3
mov dword [rsp + 0x2c], 0x100
mov ecx, 0x100
mov edx, 1
xor r8d, r8d
call fcn.140011830
mov rsi, rax
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x140073bdf
mov rcx, rsi
call fcn.1400118b0
xor esi, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007d5e0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140073bf6
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [0x1400ce610], 0
jne 0x140073c73
mov edx, dword [0x1400ce618]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r9d, eax
cmp qword [0x1400ce618], r9
ja 0x140073c73
lea rdi, [0x1400ce618]
mov rbx, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov rcx, qword [0x1400ce610]
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
mov r8d, 1
mov rdx, rdi
call fcn.1400118ba
mov qword [0x1400ce610], rax
mov edx, dword [0x1400ce618]
mov rcx, rax
call rbx
mov r9d, eax
cmp qword [0x1400ce618], r9
jbe 0x140073c32
mov rcx, qword [0x1400ce610]
lea rdx, [0x1400b701e]
mov r8, rsi
xor r9d, r9d
call fcn.14005f256
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
mov rcx, rsi
call fcn.1400118b0
mov rax, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400741fa
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r8
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
test rdx, rdx
je 0x140074236
lea r8, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x14007423a
xor ebx, ebx
xor esi, esi
jmp 0x1400742ed
xor ebp, ebp
jmp 0x140074242
mov bpl, 1
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor esi, esi
lea r9, [rsp + 0x44]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400742db
cmp dword [rsp + 0x44], 1
mov ebx, 0
jne 0x1400742dd
mov ecx, dword [rsp + 0x40]
inc ecx
xor esi, esi
mov edx, 1
xor r8d, r8d
call fcn.140011830
mov rbx, rax
mov eax, dword [rsp + 0x40]
lea rdx, [rsp + 0x3c]
mov dword [rdx], eax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x44]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400742dd
cmp dword [rsp + 0x44], 1
jne 0x1400742dd
mov eax, dword [rsp + 0x3c]
cmp eax, dword [rsp + 0x40]
jbe 0x1400742d4
xor esi, esi
jmp 0x1400742dd
mov byte [rbx + rax], 0
mov rsi, rbx
xor ebx, ebx
test bpl, bpl
je 0x1400742ed
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.1400118b0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14007d5e0
mov rax, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
ret