joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009e0bb
Capabilities:
Print debug messages

Disassembly:
jmp 0x1401bff90
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x14023ac40]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1401bffb6
jmp 0x1401c0033
mov rcx, qword [rbp + 0x30]
call fcn.14009d4bd
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1401bffcf
jmp 0x1401c0033
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1401bffec
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14009be9c
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.14009c4f5
test eax, eax
jne 0x1401c0033
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.14009d7b0
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x14009e6e7
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
jmp 0x1400be410
push rbp
push rsi
push rdi
sub rsp, 0x3e0
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x8c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14023ac40]
xor rax, rbp
mov qword [rbp + 0x3a8], rax
lea rax, [rbp + 0x10]
lea rcx, str._windir_System32StartMenuHelper64.dll
mov rdi, rax
mov rsi, rcx
mov ecx, 0x50
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x1b8
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400be4d3
mov r8d, 0x104
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, str._upgrade
lea r8, [rbp + 0x10]
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rbp - 0x30]
lea rdx, [0x1401ea290]
call fcn.14009f330
mov rcx, qword [rbp + 0x3a8]
xor rcx, rbp
call fcn.14009d7b0
lea rsp, [rbp + 0x3b0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009e7fa
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400f4300
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400f4320
xor al, al
jmp 0x1400f43a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400f4333
xor al, al
jmp 0x1400f43a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400f435d
xor al, al
jmp 0x1400f43a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400f4371
xor al, al
jmp 0x1400f43a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400f4383
xor al, al
jmp 0x1400f43a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400f439f
xor al, al
jmp 0x1400f43a1
mov al, 1
add rsp, 0x38
ret
Function at 0x14009ec23
Capabilities:
Create thread
Terminate process

Disassembly:
jmp 0x1400d6bb0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xc58
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x21a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc78]
mov rax, qword [0x14023ac40]
xor rax, rbp
mov qword [rbp + 0xc18], rax
mov eax, dword [rbp + 0xc50]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0xc48]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xc40]
lea r8, str.Expression:__s_r_nFile:__s_r_nLine:__d_n
mov edx, 0x800
lea rcx, [rbp + 0x10]
call fcn.14009ba91
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x10]
lea r8, [0x1400d6b60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x828], rax
cmp qword [rbp + 0x828], 0
je 0x1400d6cd5
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x828]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rbp + 0x844], 4
lea rdx, [rbp + 0x844]
mov rcx, qword [rbp + 0x828]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rbp + 0x844], 3
jne 0x1400d6cad
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [rbp + 0x844], 5
jne 0x1400d6cc2
mov dword [rbp + 0xc14], 1
jmp 0x1400d6ccc
mov dword [rbp + 0xc14], 0
movzx eax, byte [rbp + 0xc14]
jmp 0x1400d6cd7
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1401f0760]
call fcn.14009f330
mov rax, rdi
mov rcx, qword [rbp + 0xc18]
xor rcx, rbp
call fcn.14009d7b0
lea rsp, [rbp + 0xc28]
pop rdi
pop rbp
ret

Function at 0x14009eff7
Capabilities:
Terminate process

Disassembly:
jmp 0x140117bd0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140117bfe
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14009fc0e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14009f59c
Capabilities:
Create directory

Disassembly:
jmp 0x1400ec770
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14023ac40]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400ec7ad
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x1400ec822
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xb7
jne 0x1400ec810
mov edx, 1
mov ecx, 2
call fcn.14009b2b7
mov r9d, 0xffffffff
mov r8d, eax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.14009c770
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1400ec810
mov edx, ILClone
mov ecx, dword [rsp + 0x48]
call fcn.14009f777
movzx eax, al
test eax, eax
jne 0x1400ec810
mov dword [rsp + 0x20], 0xb7
mov byte [rsp + 0x2c], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14009d7b0
add rsp, 0x68
ret

Function at 0x14009fc86
Capabilities:
Print debug messages

Disassembly:
jmp 0x140193dc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x14009fda3
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140116b90
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1401164e0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140116bd9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140259020]
jmp 0x140116be8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x14009ff33
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400f8c90
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0x48
movzx eax, word [rsp + 0x58]
movd xmm0, eax
movdqa xmmword [rsp + 0x20], xmm0
pshuflw xmm0, xmmword [rsp + 0x20], 0
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x20]
pshufd xmm0, xmm0, 0
movdqa xmmword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x50]
and rax, 0xfff
cmp rax, 0xff0
ja 0x1400f8da1
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pxor xmm0, xmmword [rsp + 0x10]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pcmpeqw xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x30]
pcmpeqw xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
por xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pmovmskb eax, xmm0
mov dword [rsp], eax
cmp dword [rsp], 0
je 0x1400f8d91
mov eax, dword [rsp]
bsf eax, eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x1400f8d81
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
jmp 0x1400f8d8a
mov qword [rsp + 8], 0
mov rax, qword [rsp + 8]
jmp 0x1400f8ddc
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x50], rax
jmp 0x1400f8dd7
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x1400f8db9
mov rax, qword [rsp + 0x50]
jmp 0x1400f8ddc
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
test eax, eax
jne 0x1400f8dc9
xor eax, eax
jmp 0x1400f8ddc
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x1400f8ccb
add rsp, 0x48
ret
Function at 0x1400a0442
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400e9ac0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.14009ecbe
and qword [rdi + 0x50], 0
lea rax, [0x140000000]
and dword [rdi + 0x58], 0
lea rcx, [rdi + 0x28]
and dword [rdi + 0x5c], 0
xor r8d, r8d
mov qword [rdi + 0x10], rax
xor edx, edx
mov qword [rdi + 8], rax
lea rax, [0x1401f2fb8]
mov qword [rdi + 0x20], rax
mov dword [rdi], 0x60
mov dword [rdi + 0x18], 0xe00
call fcn.14009d6bb
test eax, eax
jne 0x1400e9b57
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x1400e9b57
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400e9b50
lea rcx, str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [0x14023ebb0], 1
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1401c8310
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14009be9c
sub rsp, rax
mov rax, qword [0x14023ac40]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140240c20]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, reloc.SHLWAPI.dll_SHCreateMemStream
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1401c8502
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1401c8456
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1401c8456
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1401c843b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1401c83d8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401c84c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.SHLWAPI.dll_SHCreateMemStream
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1401c8521
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1401c84fd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.SHLWAPI.dll_SHCreateMemStream
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1401c8521
jmp 0x1401c83ae
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.SHLWAPI.dll_SHCreateMemStream
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14009d7b0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1401c85d0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14009be9c
sub rsp, rax
mov rax, qword [0x14023ac40]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140240c20]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, reloc.SHLWAPI.dll_SHCreateMemStream
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1401c87dd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1401c8729
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1401c8729
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1401c8709
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1401c8698
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401c879d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.SHLWAPI.dll_SHCreateMemStream
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1401c87fc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1401c87d8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.SHLWAPI.dll_SHCreateMemStream
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1401c87fc
jmp 0x1401c866e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.SHLWAPI.dll_SHCreateMemStream
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14009d7b0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
push rsi
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
push r9
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
push rax
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140001470
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1080
call fcn.14000be70
sub rsp, rax
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140001529
mov ecx, eax
call fcn.140004d68
xor esi, esi
test al, al
je 0x140001529
mov ecx, ebx
call fcn.140004d7c
test al, al
jne 0x140001529
mov r8d, 0x800
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.14000815c
lea rcx, [rsp + 0x60]
call fcn.14000fb68
lea rax, [rax*2 + 2]
cmp rax, 0x1002
jae 0x14000154e
xor edx, edx
mov word [rsp + rax + 0x60], si
lea r8d, [rsi + 0x38]
lea rcx, [rsp + 0x20]
call fcn.14000cc30
lea eax, [rsi + 0x14]
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.14000bee0
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14000bbc4
int3

Function at 0x1400015a8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov eax, r8d
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x104
jb 0x1400015e8
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
mov edx, eax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400015e8
mov bl, 1
jmp 0x1400015fa
mov r8, rdi
lea rdx, str.unknown_folder
mov rcx, rsi
call fcn.14000815c
mov rsi, qword [rsp + 0x48]
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140001980
Capabilities:
Enumerate pe sections
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdi, [0x140022948]
mov rbx, rcx
mov rdx, rdi
lea rcx, str.Setup.rar
call fcn.140009e5c
movzx r8d, byte [rbx + 1]
lea rcx, str.Setup.zip
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 2]
lea rcx, str.Setup.cab
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 3]
lea rcx, str.Setup.arj
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 4]
lea rcx, str.Setup.lz
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 5]
lea rcx, str.Setup.lzh
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 6]
lea rcx, str.Setup.7z
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 7]
lea rcx, str.Setup.tar
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 8]
lea rcx, str.Setup.gz
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 9]
lea rcx, str.Setup.uue
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 0xa]
lea rcx, str.Setup.bz2
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 0xb]
lea rcx, str.Setup.jar
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 0xc]
lea rcx, str.Setup.iso
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 0xd]
lea rcx, str.Setup.z
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 0xe]
lea rcx, str.Setup.xz
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 0xf]
lea rcx, str.Setup.zipx
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 0x10]
lea rcx, str.Setup.001
mov rdx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 0x14]
lea rdi, str.SetupLinks
mov rcx, rdi
lea rdx, str.Desktop
call fcn.140009e5c
movzx r8d, byte [rbx + 0x15]
lea rdx, str.StartMenu
mov rcx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 0x16]
lea rdx, str.Programs
mov rcx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 0x17]
lea rdi, str.Setup
mov rcx, rdi
lea rdx, str.ShellExt
call fcn.140009e5c
movzx r8d, byte [rbx + 0x18]
lea rdx, str.CascadedMenu
mov rcx, rdi
call fcn.140009e5c
movzx r8d, byte [rbx + 0x19]
lea rdx, str.MenuIcons
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140009e5c
Function at 0x140003b6c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [rcx + 4], 0
mov r8, rcx
jne 0x140003bb3
xor r9d, r9d
mov r10d, r9d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
and cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x140003b81
mov dword [r8], r10d
inc r9d
add r8, 4
cmp r9d, 0x100
jb 0x140003b78
ret

Function at 0x1400043ac
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jne 0x1400043d9
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140004458
mov rcx, rbx
call fcn.140004504
test al, al
je 0x14000441c
mov r8d, 0x4e20
cmp rdi, r8
jbe 0x14000441c
mov rdx, rsi
mov rcx, rbx
call fcn.1400043ac
jmp 0x14000445c
cmp dword [rbx + 0x14], 1
jne 0x140004431
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x140004431
xor eax, eax
jmp 0x14000445c
cmp dword [rbx + 0x14], 0
jne 0x140004453
cmp rdi, 0x8000
jbe 0x140004453
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x140004453
mov r8d, 0x8000
jmp 0x14000440f
or eax, 0xffffffff
jmp 0x14000445c
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret