joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f660
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x48]
lea rdx, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000f696
xor al, al
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.DisabledComponents
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x40], 0x8e
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x30]
sete al
add rsp, 0x38
ret

Function at 0x14000fd10
Capabilities:
Compute adler32 checksum

Disassembly:
movzx r9d, cx
shr ecx, 0x10
mov r10, rdx
test rdx, rdx
jne 0x14000fd23
lea eax, [rdx + 1]
ret
test r8d, r8d
je 0x14000fe60
nop dword [rax]
mov edx, 0x15b0
cmp r8d, edx
cmovb edx, r8d
sub r8d, edx
cmp edx, 0x10
jl 0x14000fe1c
mov r11d, edx
shr r11, 4
mov eax, r11d
neg eax
shl eax, 4
add edx, eax
nop dword [rax]
movzx eax, byte [r10]
add r10, 0x10
add r9d, eax
movzx eax, byte [r10 - 0xf]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xe]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xd]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xc]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xb]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xa]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 9]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 8]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 7]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 1]
add ecx, r9d
add r9d, eax
add ecx, r9d
dec r11
jne 0x14000fd60
test edx, edx
je 0x14000fe31
movzx eax, byte [r10]
inc r10
add r9d, eax
add ecx, r9d
dec edx
jne 0x14000fe20
mov eax, 0x80078071
mul r9d
mov eax, 0x80078071
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
test r8d, r8d
jne 0x14000fd30
shl ecx, 0x10
or ecx, r9d
mov eax, ecx
ret
Function at 0x140010560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x38]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x8c]
mov esi, dword [rdi + 0x50]
mov eax, dword [rdi + 0x38]
sub esi, dword [rdi + 0x94]
lea ecx, [rbx + rax - 0x106]
sub esi, edx
cmp edx, ecx
jb 0x14001060f
mov rcx, qword [rdi + 0x48]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.140023560
mov r8d, dword [rdi + 0x6c]
mov rax, qword [rdi + 0x60]
sub dword [rdi + 0x90], ebx
sub dword [rdi + 0x8c], ebx
sub dword [rdi + 0x7c], ebx
lea rdx, [rax + r8*2]
nop word [rax + rax]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x1400105e0
sub eax, ebx
jmp 0x1400105e2
xor eax, eax
dec r8d
mov word [rdx], ax
jne 0x1400105d0
mov rax, qword [rdi + 0x58]
mov edx, ebx
lea rcx, [rax + rbx*2]
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x140010604
sub eax, ebx
jmp 0x140010606
xor eax, eax
dec edx
mov word [rcx], ax
jne 0x1400105f4
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x140010686
mov edx, dword [rdi + 0x94]
mov eax, dword [rdi + 0x8c]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x48]
call fcn.140010220
add dword [rdi + 0x94], eax
mov r9d, dword [rdi + 0x94]
cmp r9d, 3
jb 0x140010670
mov eax, dword [rdi + 0x8c]
mov rdx, qword [rdi + 0x48]
mov ecx, dword [rdi + 0x78]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x68], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x74]
mov dword [rdi + 0x68], r8d
cmp r9d, 0x106
jae 0x140010686
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x140010580
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140014e20
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
jne 0x140014e35
xor eax, eax
add rsp, 0x38
ret
mov qword [rsp + 0x30], rbx
xor ebx, ebx
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
cmovne ebx, dword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret

Function at 0x140014e70
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
jne 0x140014e85
xor eax, eax
add rsp, 0x38
ret
mov qword [rsp + 0x30], rbx
xor ebx, ebx
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
cmovne ebx, dword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret

Function at 0x140014ec0
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
jne 0x140014ed5
xor eax, eax
add rsp, 0x28
ret
lea rdx, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x140015070
Capabilities:
Clear file content

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx + 8], 0xffffffffffffffff
mov rdi, rcx
jne 0x140015088
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov rax, qword [rcx]
xor edx, edx
mov qword [rsp + 0x30], rbx
lea r8d, [rdx + 1]
call qword [rax + 0x10]
mov rcx, qword [rdi + 8]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400150c0
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 8], 0xffffffffffffffff
mov rbx, rcx
je 0x1400150e5
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x10]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
add rsp, 0x20
pop rbx
ret
Function at 0x1400156e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140050808]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
xor edi, edi
test rcx, rcx
je 0x140015711
mov rax, qword [rcx]
call qword [rax + htons]
mov qword [rbx + 8], rdi
mov ecx, 0x30
call fcn.140024708
test rax, rax
je 0x1400157e4
mov qword [rax + 8], rdi
lea rcx, vtable.StLibs::MemoryStream.0
mov qword [rax], rcx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x28], 0x6400000
mov dword [rax + 0x2c], 1
lea rcx, vtable.StLibs::IOB.0
mov qword [rax + 0x10], rcx
mov qword [rbx + 8], rax
mov eax, dword [0x140054288]
mov dword [rbx + 0x10], 0x40000
mov word [rbx + 0x16], di
test al, 1
jne 0x140015781
or eax, 1
lea rcx, [0x14003b270]
mov dword [0x140054288], eax
call fcn.140024f3c
lea rdx, [rsp + 0x20]
lea rcx, [0x140054080]
call fcn.14001b0b0
cmp qword [rsp + 0x30], rdi
je 0x1400157c1
cmp qword [rsp + 0x38], 8
lea r9, [rsp + 0x20]
lea r8, [0x140044730]
cmovae r9, qword [rsp + 0x20]
lea rcx, [rbx + 0x16]
mov edx, 0x104
call fcn.140015590
jmp 0x1400157d0
lea rdx, [rbx + 0x16]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp qword [rsp + 0x38], 8
jb 0x1400157e2
mov rcx, qword [rsp + 0x20]
call fcn.14002428c
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140023220
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140015840
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x280
mov rax, qword [0x140050808]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x14001586e
xor eax, eax
jmp 0x1400159dd
mov rax, qword [rcx]
mov qword [rsp + 0x270], rbp
call qword [rax + 0x20]
mov ebp, eax
test eax, eax
je 0x1400159d5
cmp byte [rsi + 0x14], 0
mov qword [rsp + 0x268], rdi
mov qword [rsp + 0x260], r12
jne 0x1400159c3
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov ecx, dword [rsi + 0x10]
cmp rax, rcx
jbe 0x1400159c3
lea rcx, [rsi + 0x16]
lea r9, [rsp + 0x40]
lea rdx, [0x140044738]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1400159c3
mov ecx, 0x10
call fcn.140024708
mov rdi, rax
test rax, rax
je 0x1400159c3
lea rax, vtable.StLibs::FileStream.0
mov qword [rdi + 8], 0xffffffffffffffff
mov qword [rdi], rax
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
je 0x140015917
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], 0xffffffffffffffff
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x4000100
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x14001595f
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
jmp 0x1400159c3
mov rcx, qword [rsi + 8]
xor edx, edx
mov qword [rsp + 0x278], rbx
mov rax, qword [rcx]
lea r8d, [rdx + 1]
call qword [rax + 0x10]
mov rcx, qword [rsi + 8]
mov rdx, rdi
mov r8, qword [rcx]
mov r12, rax
call qword [r8 + 0x30]
mov rcx, qword [rsi + 8]
mov rdx, qword [rcx]
mov rbx, rax
call qword [rdx + 0x28]
cmp rbx, rax
mov rbx, qword [rsp + 0x278]
jne 0x140015950
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax + htons]
mov qword [rsi + 8], rdi
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [rax + 0x10]
mov byte [rsi + 0x14], 1
mov rdi, qword [rsp + 0x268]
mov r12, qword [rsp + 0x260]
mov eax, ebp
mov rbp, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140023220
add rsp, 0x280
pop rsi
ret
Function at 0x14001af90
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140050808]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
mov r8, rdx
sub rcx, rdx
nop word [rax + rax]
movzx eax, word [r8]
add r8, 2
mov word [rcx + r8 - 2], ax
test ax, ax
jne 0x14001afc0
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14001b011
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001b01c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x40]
sub rcx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x14001b030
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14001b081
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001b08e
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov al, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140023220
add rsp, 0x260
pop rbx
ret

Function at 0x14002410c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140024122
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140024124
xor eax, eax
test eax, eax
je 0x140024134
mov ecx, eax
call fcn.140025a2c
or eax, 0xffffffff
jmp 0x140024136
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400292c7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140050808]
jne 0x14002323a
rol rcx, 0x10
test cx, 0xffff
jne 0x140023236
repz ret
ror rcx, 0x10
jmp 0x140029220
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140052660]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140052758]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400292a5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140052660]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400292c7
mov rax, qword [rsp + 0x88]
mov qword [0x140052758], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400526f8], rax
mov rax, qword [0x140052758]
mov qword [0x1400525d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400526e0], rax
mov dword [0x1400525c0], 0xc0000409
mov dword [0x1400525c4], 1
mov rax, qword [0x140050808]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140050810]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140052658], eax
mov ecx, 1
call fcn.140032458
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14003d410]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140052658], 0
jne 0x14002934e
mov ecx, 1
call fcn.140032458
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14002a0d8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140029f48
Function at 0x140034188
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140050808]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14002b7cc
xor ebx, ebx
cmp qword [0x140053620], rbx
mov rdi, rax
jne 0x14003429b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140034372
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140034372
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140053620], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140053628], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140053630], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140053640], rax
test rax, rax
je 0x140034292
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140053638], rax
jmp 0x1400342a2
mov rax, qword [0x140053638]
jmp 0x1400342a9
mov rax, qword [0x140053638]
mov r11, qword [0x140053640]
cmp rax, rdi
je 0x140034310
cmp r11, rdi
je 0x140034310
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140053640]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140034310
test rax, rax
je 0x140034310
call rsi
test rax, rax
je 0x14003430a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14003430a
test byte [rsp + 0x40], 1
jne 0x140034310
bts ebp, 0x15
jmp 0x140034350
mov rcx, qword [0x140053628]
cmp rcx, rdi
je 0x140034350
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140034350
call rax
mov rbx, rax
test rax, rax
je 0x140034350
mov rcx, qword [0x140053630]
cmp rcx, rdi
je 0x140034350
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140034350
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140053620]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140034372
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140034374
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140023220
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140013030
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011280
Capabilities:
Check if file exists
Read file on windows

Disassembly:
jmp 0x1400118b0
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x188], rax
lea rcx, [0x1400230a2]
call fcn.140011389
lea rax, [rbp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x1c
rep stosb byte [rdi], al
lea rax, [rbp + 0xa8]
mov rdi, rax
xor eax, eax
mov ecx, 0x14
rep stosb byte [rdi], al
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str.COM2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
jne 0x14001196f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140011963
lea rcx, str.ERROR___COM2_PORT_NOT_FOUND_n
call fcn.14001119a
lea rcx, str.ERROR___FAIIED_TO_ACCESS_TO_COM2_SUCCESSFULLY_n
call fcn.14001119a
mov dword [rbp + 0x68], 0x1c
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetCommState]
test eax, eax
jne 0x140011994
lea rcx, str.ERROR___FAIIED_TO_GET_SERIAL_PARAMETERS_n
call fcn.14001119a
mov dword [rbp + 0x6c], 0xe100
mov byte [rbp + 0x7a], 8
mov byte [rbp + 0x7b], 0
mov byte [rbp + 0x7c], 0
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetCommState]
test eax, eax
jne 0x1400119c5
lea rcx, str.ERROR__Setting_serial_port_state
call fcn.14001119a
mov dword [rbp + 0xa8], 0x32
mov dword [rbp + 0xb0], 0x32
mov dword [rbp + 0xac], 0xa
mov dword [rbp + 0xb8], 0x32
mov dword [rbp + 0xb4], 0xa
lea rdx, [rbp + 0xa8]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
test eax, eax
jne 0x140011a21
lea rcx, str.ERROR___Time_Out_n
call fcn.14001119a
mov eax, 1
jmp 0x140011a6f
xor eax, eax
cmp eax, 1
je 0x140011a63
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x44]
mov r8d, 1
lea rdx, [rbp + 4]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x44], 1
jne 0x140011a61
movsx eax, byte [rbp + 4]
mov edx, eax
lea rcx, [0x14001aeb0]
call fcn.14001119a
jmp 0x140011a21
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001ad70]
call fcn.140011325
mov rax, rdi
mov rcx, qword [rbp + 0x188]
xor rcx, rbp
call fcn.1400111b3
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x14001128a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014380
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400143a0
xor al, al
jmp 0x140014421
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400143b3
xor al, al
jmp 0x140014421
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400143dd
xor al, al
jmp 0x140014421
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400143f1
xor al, al
jmp 0x140014421
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014403
xor al, al
jmp 0x140014421
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001441f
xor al, al
jmp 0x140014421
mov al, 1
add rsp, 0x38
ret
Function at 0x140001570
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x278
mov rbx, rcx
or rsi, 0xffffffffffffffff
nop dword [rax]
nop word [rax + rax]
add rsi, 1
cmp word [rbx + rsi*2], 0
jne 0x140001590
lea rdx, [rbx + rsi*2]
lea r8, [0x14001a24a]
xor ecx, ecx
nop dword [rax + rax]
mov ax, word [r8 + rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x1400015b0
mov rcx, rbx
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov word [rbx + rsi*2], 0
cmp rdi, 0xffffffffffffffff
je 0x14000170c
xor r12d, r12d
lea rdx, [rsp + 0x4c]
lea r8, [0x14001a246]
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x14000160c
add rcx, 2
test ax, ax
jne 0x1400015f4
xor eax, eax
jmp 0x140001611
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1400016be
lea rdx, [rsp + 0x4c]
lea r8, [0x14001a240]
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x14000163f
add rcx, 2
test ax, ax
jne 0x140001627
xor eax, eax
jmp 0x140001644
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1400016be
lea rdx, [rbx + rsi*2]
lea r8, [rsp + 0x4c]
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
mov ax, word [r8 + rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x140001660
test dword [rsp + 0x20], 0x10
je 0x140001698
mov rcx, rbx
lea rdx, [0x14001a392]
call fcn.14000e040
mov rcx, rbx
call fcn.140001570
mov r12d, eax
jmp 0x1400016b9
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400016b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
test r12d, r12d
jne 0x1400016e6
mov rcx, rdi
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400015e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp r12d, 0x12
jne 0x1400016e6
xor r12d, r12d
mov word [rbx + rsi*2], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
test r12d, r12d
jne 0x140001707
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140001714
mov eax, r12d
jmp 0x14000171d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000171d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
add rsp, 0x278
pop r12
pop rdi
pop rsi
pop rbx
ret