joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f140
Capabilities:
Create directory
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, section..rdata
xor esi, esi
lea r9, [rsp + 0x20]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x14000f196
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.140021f88
cmp rax, 0x105
jb 0x14000f1ad
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140023e80
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8d, 0x105
mov rcx, rdi
mov rdx, rbx
call fcn.140022450
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.Mozilla_Maintenance_Service
mov rcx, rdi
call fcn.140010040
test eax, eax
je 0x14000f196
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000f1fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000f196
lea rdx, str.UpdateLogs
mov rcx, rdi
call fcn.140010040
test eax, eax
je 0x14000f196
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000f22f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000f196
mov esi, 1
jmp 0x14000f196
Function at 0x14000f980
Capabilities:
Query service status

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
xor edx, edx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x14000fa91
mov r14, rax
mov rcx, rax
mov rdx, rdi
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x14000fab4
mov rdi, rax
mov dword [rsp + 0x3c], 0xcf
imul ebp, ebx, 0x3e8
test ebp, ebp
je 0x14000fadb
xor esi, esi
lea r15, [rsp + 0x34]
lea r12, [rsp + 0x38]
mov rbx, qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000fa2e
cmp dword [rsp + 0x3c], 1
je 0x14000fafc
mov ecx, 0x32
call r13
add esi, 0x32
cmp esi, ebp
jae 0x14000faf6
mov qword [rsp + 0x20], r15
mov rcx, rdi
xor edx, edx
mov r8, r12
mov r9d, 0x24
call rbx
test eax, eax
jne 0x14000fa10
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jle 0x14000fa64
lea ecx, [rax - 0x425]
cmp ecx, 2
jb 0x14000fa1b
jmp 0x14000fb77
cmp eax, 0x79
jle 0x14000fb47
cmp eax, 0x41c
je 0x14000fa1b
cmp eax, 0x7a
je 0x14000fb9a
cmp eax, 0x7c
jne 0x14000fb8c
mov ebx, 0xdd
mov dword [rsp + 0x3c], ebx
jmp 0x14000fb01
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x429
sete cl
xor ecx, 0xff
cmp eax, 5
mov ebx, 0xfd
cmovne ebx, ecx
jmp 0x14000fb12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, 0x7a
jg 0x14000fae2
cmp edi, 5
je 0x14000fb32
cmp edi, 6
jne 0x14000fb40
mov ebx, 0xec
jmp 0x14000fb12
mov ebx, 0xcf
jmp 0x14000fb01
cmp edi, 0x7b
je 0x14000fb39
cmp edi, 0x424
jne 0x14000fb40
mov ebx, 0xee
jmp 0x14000fb12
mov ebx, dword [rsp + 0x3c]
jmp 0x14000fb01
mov ebx, 1
mov rsi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call rsi
mov rcx, r14
call rsi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140023e80
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebx, 0xeb
jmp 0x14000fb12
mov ebx, 0xed
jmp 0x14000fb12
mov ebx, 0xef
jmp 0x14000fb12
cmp eax, 5
je 0x14000fb61
cmp eax, 6
je 0x14000fb6c
cmp eax, 0x57
jne 0x14000fb8c
mov ebx, 0xdc
mov dword [rsp + 0x3c], ebx
jmp 0x14000fb01
mov ebx, 0xda
mov dword [rsp + 0x3c], ebx
jmp 0x14000fb01
mov ebx, 0xd9
mov dword [rsp + 0x3c], ebx
jmp 0x14000fb01
cmp eax, 0x45b
jne 0x14000fb8c
mov ebx, 0xde
mov dword [rsp + 0x3c], ebx
jmp 0x14000fb01
mov ebx, 0xdf
mov dword [rsp + 0x3c], ebx
jmp 0x14000fb01
mov ebx, 0xdb
mov dword [rsp + 0x3c], ebx
jmp 0x14000fb01
Function at 0x14000fbb0
Capabilities:
Start service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov ebx, ecx
lea r15d, [rbx + 2]
movsxd rax, r15d
mov ecx, 8
mul rcx
mov rcx, 0xffffffffffffffff
cmovno rcx, rax
call fcn.140013d44
mov rsi, rax
lea rax, str.software_update
movq xmm0, rax
lea rax, str.MozillaMaintenance
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqu xmmword [rsi], xmm1
test ebx, ebx
jle 0x14000fc1e
mov r8d, ebx
lea rcx, [rsi + 0x10]
shl r8, 3
mov rdx, rdi
call fcn.140027db0
lea rcx, str.MozillaMaintenance
mov edx, 5
call fcn.14000f980
cmp eax, 1
jne 0x14000fcd9
xor ecx, ecx
xor edx, edx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x14000fce3
mov rbx, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 0x10
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x14000fcea
mov rdi, rax
mov qword [rsp + 0x20], rbx
xor ebp, ebp
mov r12, qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
xor r13d, r13d
nop
mov rcx, rdi
mov edx, r15d
mov r8, rsi
call r12
test eax, eax
jne 0x14000fcbf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, 0x64
call r14
add r13d, 0x64
cmp r13d, 0x1388
jb 0x14000fc90
mov ebp, ebx
mov rbx, qword [rsp + 0x20]
mov r14, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call r14
mov rcx, rbx
call r14
jmp 0x14000fcf8
mov ebp, eax
add ebp, 0x4e20
jmp 0x14000fcf8
mov ebp, 0x4269
jmp 0x14000fcf8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, 0x426a
mov rcx, rsi
call fcn.140013d4c
mov eax, ebp
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000fd20
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x238], rax
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
xor edx, edx
call fcn.140015fa0
mov rcx, rdi
call fcn.140021f88
cmp rax, 0x104
ja 0x14000fd9d
lea rbx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
mov rdx, rdi
call fcn.140022450
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 3
sete cl
mov dword [rsi], ecx
mov ebx, 1
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.140023e80
mov eax, ebx
add rsp, 0x240
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000fdc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
call fcn.14000eb90
test al, al
je 0x14000feb7
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
xor edi, edi
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000feb7
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x44], 4
lea rbx, [rsp + 0x44]
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, str.ConsentPromptBehaviorAdmin
xor edi, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14000fe60
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000feb7
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rdx, str.PromptOnSecureDesktop
xor edi, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000feb7
xor eax, eax
cmp dword [rsp + 0x34], 0
jne 0x14000feb0
xor eax, eax
cmp dword [rsp + 0x30], 0
sete al
mov dword [rsi], eax
mov edi, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140023e80
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x14000ff70
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push rsi
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x278], rax
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x14000ffe4
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14001001a
lea rdx, [rsp + 0x54]
lea rsi, [0x140048568]
mov r8d, 0x105
mov rcx, rsi
call fcn.140022450
mov word [0x140048770], 0
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140023e80
mov rax, rsi
add rsp, 0x280
pop rsi
ret
lea rcx, [rsi + 8]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
jne 0x14000ffa5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.14001b914
cmp esi, 2
mov ecx, 9
cmove ecx, esi
mov dword [rax], ecx
xor esi, esi
jmp 0x14000ffc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x140010029
xor esi, esi
jmp 0x14000ffc8
call fcn.14001b914
mov dword [rax], 2
xor esi, esi
jmp 0x14000ffc8
Function at 0x1400102f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea r8, [0x14003d8bc]
lea rcx, [rsp + 0x28]
mov rdx, rsi
call fcn.14001f3dc
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x140010351
mov ecx, 0x818
call fcn.1400215bc
test rax, rax
je 0x14001037f
mov rsi, rax
mov qword [rax], rdi
mov rcx, rax
add rcx, 8
mov r8d, 0x80c
xor edx, edx
call fcn.140015fa0
jmp 0x140010389
mov ecx, 2
call fcn.140016828
lea rcx, str.ERROR:_could_not_open_file_in_mar_wopen___n
mov edx, 0x2a
mov r8d, 1
mov r9, rax
call fcn.1400210f8
mov rcx, rsi
call fcn.14001f528
jmp 0x140010387
mov rcx, rdi
call fcn.140020874
xor esi, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140023e80
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x140010af0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, dword [rdx + 0xc]
xor ebx, ebx
sub ebp, r8d
je 0x140010b44
mov ebx, 0xffffffff
jl 0x140010b44
mov rsi, r9
mov rdi, rcx
add r8d, dword [rdx + 8]
mov rcx, qword [rcx]
mov edx, r8d
xor r8d, r8d
call fcn.14001bd18
test eax, eax
jne 0x140010b44
mov eax, dword [rsp + 0x70]
cmp ebp, eax
cmovg ebp, eax
mov r9, qword [rdi]
movsxd r8, ebp
mov edx, 1
mov rcx, rsi
call fcn.140020e34
mov rbx, rax
mov eax, ebx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140010b50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movdqa xmm0, xmmword [0x14003a820]
xor eax, eax
movdqa xmm1, xmmword [0x14003a830]
movdqa xmm2, xmmword [0x14003a840]
lea rcx, [0x140048780]
movdqa xmm3, xmmword [0x14003a850]
nop word cs:[rax + rax]
nop dword [rax]
movdqa xmm4, xmm0
psrld xmm4, 1
movdqa xmm5, xmm0
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrld xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubd xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrld xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrld xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubd xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrld xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
movdqa xmmword [rax + rcx], xmm5
paddd xmm0, xmm3
add rax, 0x10
cmp rax, 0x400
jne 0x140010b90
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret

Function at 0x140010c90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movdqa xmm0, xmmword [0x14003a860]
xor eax, eax
movdqa xmm1, xmmword [0x14003a870]
movdqa xmm2, xmmword [0x14003a880]
lea rcx, [0x140048b80]
movdqa xmm3, xmmword [0x14003a890]
nop word cs:[rax + rax]
nop dword [rax]
movdqa xmm4, xmm0
psrlq xmm4, 1
movdqa xmm5, xmm0
pand xmm5, xmm1
pxor xmm6, xmm6
psubq xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrlq xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubq xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrlq xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubq xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrlq xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubq xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrlq xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubq xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrlq xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubq xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrlq xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubq xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrlq xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubq xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
movdqa xmmword [rax + rcx], xmm5
paddq xmm0, xmm3
add rax, 0x10
cmp rax, 0x800
jne 0x140010cd0
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x140011620
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov r10, rcx
mov rax, qword [r8]
cmp dword [rcx], 4
jne 0x140011640
sub r9, rax
cmp r9, 5
jae 0x140011647
xor esi, esi
jmp 0x1400117df
add rdx, rax
mov r12d, dword [r10 + 0x10]
add r9, 0xfffffffffffffffc
mov rax, 0xffffffffffffffff
xor esi, esi
lea r15, [0x14003a8b0]
mov r14d, 0x17
jmp 0x140011683
mov rcx, rsi
mov rsi, rcx
add rsi, 1
cmp rsi, r9
jae 0x1400117c2
mov cl, byte [rdx + rsi]
and cl, 0xfe
cmp cl, 0xe8
jne 0x140011670
mov rcx, rsi
sub rcx, rax
cmp rcx, 3
jbe 0x1400116a0
xor r12d, r12d
jmp 0x1400116e0
add cl, 0xff
shl r12d, cl
mov eax, r12d
and eax, 7
mov r12d, 0
test eax, eax
je 0x1400116e0
bt r14d, eax
jae 0x1400117af
movzx ecx, byte [rax + r15]
mov rdi, rsi
sub rdi, rcx
mov cl, byte [rdi + rdx + 4]
add cl, 1
cmp cl, 1
jbe 0x1400117af
mov r12d, eax
nop
movzx ebx, byte [rdx + rsi + 4]
lea eax, [rbx + 1]
cmp al, 1
jbe 0x1400116f9
lea r12d, [r12 + r12]
add r12d, 1
jmp 0x1400117b7
movzx eax, byte [rdx + rsi + 1]
movzx ecx, byte [rdx + rsi + 2]
shl ecx, 8
movzx ebp, byte [rdx + rsi + 3]
shl ebp, 0x10
shl ebx, 0x18
or ebx, eax
or ebx, ecx
or ebx, ebp
mov eax, dword [r10 + 0xc]
add eax, esi
mov r13d, 0xfffffffb
sub r13d, eax
add ebx, r13d
test r12d, r12d
je 0x140011785
mov eax, r12d
movzx r11d, byte [rax + r15]
shl r11d, 3
mov eax, 0x18
sub eax, r11d
mov ebp, ebx
mov ecx, eax
shr ebp, cl
add bpl, 1
cmp bpl, 1
ja 0x140011785
neg r11b
mov ebp, 0xffffffff
mov ecx, r11d
shl ebp, cl
not ebp
nop word cs:[rax + rax]
nop dword [rax + rax]
xor ebx, ebp
add ebx, r13d
mov edi, ebx
mov ecx, eax
shr edi, cl
add dil, 1
cmp dil, 2
jb 0x140011770
lea rcx, [rsi + 4]
mov eax, ebx
and eax, 0x1000000
mov ebp, eax
neg ebp
or ebp, eax
mov byte [rdx + rsi + 1], bl
mov byte [rdx + rsi + 2], bh
shr ebx, 0x10
mov byte [rdx + rsi + 3], bl
shr ebp, 0x18
mov byte [rdx + rsi + 4], bpl
jmp 0x1400117ba
lea r12d, [rax + rax]
add r12d, 1
mov rcx, rsi
mov rax, rsi
jmp 0x140011673
mov rdx, rsi
sub rdx, rax
lea ecx, [rdx - 1]
shl r12d, cl
xor eax, eax
cmp rdx, 3
cmovbe eax, r12d
mov dword [r10 + 0x10], eax
mov rax, qword [r8]
add rax, rsi
mov qword [r8], rax
add dword [r10 + 0xc], esi
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14001ac9c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001add4

Function at 0x14001f614
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001f634
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001b954
or eax, 0xffffffff
jmp 0x14001f636
xor eax, eax
add rsp, 0x28
ret

Function at 0x14001f66c
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14001f68c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001b954
or eax, 0xffffffff
jmp 0x14001f68e
xor eax, eax
add rsp, 0x28
ret
Function at 0x140008188
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14000d868], rdi
je 0x1400081e8
cmp rax, rdi
jne 0x1400081db
mov r12d, 1
jmp 0x1400081e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400081c1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x1400081fd
lea ecx, [rax + 0x1e]
call fcn.14016a000
jmp 0x140008264
mov eax, dword [0x14000d860]
cmp eax, ebx
jne 0x14000825a
mov dword [0x14000d860], 1
lea r13, [0x140001548]
lea rdi, [0x140001530]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000824c
cmp eax, ebx
jne 0x14000824c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140008241
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000822a
cmp eax, ebx
je 0x140008264
mov eax, 0xff
jmp 0x1400083ac
mov dword [0x14000b554], 1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x14000828c
lea rdx, [0x140001528]
lea rcx, [0x1400014b8]
call sub.msvcrt.dll__initterm
mov dword [0x14000d860], 2
cmp r12d, ebx
jne 0x14000829b
mov rax, rbx
xchg qword [0x14000d868], rax
cmp qword [0x14000d870], rbx
je 0x1400082c3
lea rcx, [0x14000d870]
call fcn.14000862c
cmp eax, ebx
je 0x1400082c3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14000d870]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1400082d9
mov eax, 0xff
jmp 0x1400083ac
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000835e
cmp word [rcx], bx
je 0x1400082f4
cmp edx, ebx
jne 0x14000835e
cmp word [rcx], bx
je 0x14000830a
cmp word [rcx], 0x20
ja 0x14000830a
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082f4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003b3c
mov dword [0x14000b550], eax
cmp dword [0x14000b534], ebx
jne 0x140008348
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b554], ebx
jne 0x14000835c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b550]
jmp 0x1400083ac
cmp word [rcx], 0x22
jne 0x140008371
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082e5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.1400087ec
add rsp, 0x28
jmp 0x140008188
Function at 0x140003c70
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x1080
call fcn.14000e480
sub rsp, rax
mov rax, qword [0x14001e010]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov r14, qword [rsp + 0x10d0]
xor ebx, ebx
mov rbp, r9
mov rdi, r8
mov rsi, rcx
test r8, r8
je 0x140003d99
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
lea r9d, [rbx + 0x28]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
mov dword [rsp + 0x28], ebx
mov edx, 0x80862007
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0x33
mov qword [rsp + 0x68], 0x1000
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140003d15
lea rdx, str.____Cant_read_module_headers
jmp 0x140003d7d
movsxd rax, dword [rsp + 0xac]
lea rcx, [rsp + 0x70]
add rcx, rax
mov r8d, ebx
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
movzx r9d, word [rcx + 6]
add r10, rax
test r9d, r9d
je 0x140003d76
nop dword [rax]
mov eax, r8d
lea rcx, [rax + rax*4]
cmp dword [r10 + rcx*8], 0x45474150
lea rdx, [r10 + rcx*8]
jne 0x140003d6e
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdx + rax], bl
jne 0x140003d60
cmp rax, 4
je 0x140003dcd
inc r8d
cmp r8d, r9d
jb 0x140003d40
lea rdx, str.____Cant_find_section
mov rcx, qword [0x14000f270]
call fcn.140005cf0
lea rdx, [0x140005ec0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, rbx
mov r8d, ebx
mov r9, rbp
mov rcx, rsi
mov qword [rsp + 0x20], r14
call fcn.140003ab0
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.14000d260
add rsp, 0x1080
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8d, dword [rdx + 0xc]
lea rax, [rsp + 0x70]
mov ecx, dword [rdx + 8]
add rax, r8
je 0x140003d76
test ecx, ecx
je 0x140003d76
mov ebx, ecx
lea rdx, [r8 + rdi]
jmp 0x140003d9c
Function at 0x140004ad0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140004b07
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140004b28
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140004b2a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140004b83
test ecx, ecx
jle 0x140004b63
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140004b83
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140004b83
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret