joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006c590
Capabilities:
Encrypt data using tea

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp + 0x10], 0x20
imul eax, dword [rsp + 0x10], 0x9e3779b9
mov dword [rsp + 0xc], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0xc]
shr eax, 2
and eax, 3
mov dword [rsp + 0x18], eax
mov dword [rsp], 1
jmp 0x14006c5e6
mov eax, dword [rsp]
dec eax
mov dword [rsp], eax
cmp dword [rsp], 0
jbe 0x14006c68a
mov eax, dword [rsp]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 8], eax
mov eax, dword [rsp]
mov ecx, dword [rsp + 8]
shr ecx, 5
mov edx, dword [rsp + 4]
shl edx, 2
xor ecx, edx
mov edx, dword [rsp + 4]
shr edx, 3
mov r8d, dword [rsp + 8]
shl r8d, 4
xor edx, r8d
add ecx, edx
mov edx, dword [rsp + 4]
mov r8d, dword [rsp + 0xc]
xor r8d, edx
mov edx, r8d
mov r8d, dword [rsp]
and r8d, 3
xor r8d, dword [rsp + 0x18]
mov r8d, r8d
mov r9, qword [rsp + 0x38]
mov r10d, dword [rsp + 8]
mov r8d, dword [r9 + r8*4]
xor r8d, r10d
add edx, r8d
xor ecx, edx
mov rdx, qword [rsp + 0x30]
mov eax, dword [rdx + rax*4]
sub eax, ecx
mov dword [rsp + 0x14], eax
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rsp + 0x14]
mov dword [rcx + rax*4], edx
mov eax, dword [rsp + 0x14]
mov dword [rsp + 4], eax
jmp 0x14006c5de
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax]
mov dword [rsp + 8], eax
mov eax, 4
imul rax, rax, 0
mov ecx, dword [rsp + 8]
shr ecx, 5
mov edx, dword [rsp + 4]
shl edx, 2
xor ecx, edx
mov edx, dword [rsp + 4]
shr edx, 3
mov r8d, dword [rsp + 8]
shl r8d, 4
xor edx, r8d
add ecx, edx
mov edx, dword [rsp + 4]
mov r8d, dword [rsp + 0xc]
xor r8d, edx
mov edx, r8d
mov r8d, dword [rsp]
and r8d, 3
xor r8d, dword [rsp + 0x18]
mov r8d, r8d
mov r9, qword [rsp + 0x38]
mov r10d, dword [rsp + 8]
mov r8d, dword [r9 + r8*4]
xor r8d, r10d
add edx, r8d
xor ecx, edx
mov rdx, qword [rsp + 0x30]
mov eax, dword [rdx + rax]
sub eax, ecx
mov dword [rsp + 0x1c], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov edx, dword [rsp + 0x1c]
mov dword [rcx + rax], edx
mov eax, dword [rsp + 0x1c]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0xc]
sub eax, 0x9e3779b9
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x10]
dec eax
mov dword [rsp + 0x10], eax
cmp dword [rsp + 0x10], 0
jne 0x14006c5c7
add rsp, 0x28
ret
Function at 0x140070070
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov byte [rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x44], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x44], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x4c], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x4c], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x4c], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x4c], 0x10325476
ret
Function at 0x140070ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2980
call fcn.14002fc80
sub rsp, rax
mov qword [rsp + 0x150], 0xfffffffffffffffe
mov rax, qword [0x1402008c8]
xor rax, rsp
mov qword [rsp + 0x2970], rax
mov dword [rsp + 0x130], 0x2710
mov byte [rsp + 0x230], 0x77
mov byte [rsp + 0x231], 0x6d
mov byte [rsp + 0x232], 0x69
mov byte [rsp + 0x233], 0x63
mov byte [rsp + 0x234], 0x20
mov byte [rsp + 0x235], 0x42
mov byte [rsp + 0x236], 0x61
mov byte [rsp + 0x237], 0x73
mov byte [rsp + 0x238], 0x65
mov byte [rsp + 0x239], 0x42
mov byte [rsp + 0x23a], 0x6f
mov byte [rsp + 0x23b], 0x61
mov byte [rsp + 0x23c], 0x72
mov byte [rsp + 0x23d], 0x64
mov byte [rsp + 0x23e], 0x20
mov byte [rsp + 0x23f], 0x67
mov byte [rsp + 0x240], 0x65
mov byte [rsp + 0x241], 0x74
mov byte [rsp + 0x242], 0x20
mov byte [rsp + 0x243], 0x53
mov byte [rsp + 0x244], 0x65
mov byte [rsp + 0x245], 0x72
mov byte [rsp + 0x246], 0x69
mov byte [rsp + 0x247], 0x61
mov byte [rsp + 0x248], 0x6c
mov byte [rsp + 0x249], 0x4e
mov byte [rsp + 0x24a], 0x75
mov byte [rsp + 0x24b], 0x6d
mov byte [rsp + 0x24c], 0x62
mov byte [rsp + 0x24d], 0x65
mov byte [rsp + 0x24e], 0x72
mov byte [rsp + 0x24f], 0
mov byte [rsp + 0x220], 0x53
mov byte [rsp + 0x221], 0x65
mov byte [rsp + 0x222], 0x72
mov byte [rsp + 0x223], 0x69
mov byte [rsp + 0x224], 0x61
mov byte [rsp + 0x225], 0x6c
mov byte [rsp + 0x226], 0x4e
mov byte [rsp + 0x227], 0x75
mov byte [rsp + 0x228], 0x6d
mov byte [rsp + 0x229], 0x62
mov byte [rsp + 0x22a], 0x65
mov byte [rsp + 0x22b], 0x72
mov byte [rsp + 0x22c], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
mov byte [rsp + 0x250], 0
lea rax, [rsp + 0x251]
mov rdi, rax
xor eax, eax
mov ecx, 0x2710
rep stosb byte [rdi], al
lea rcx, [rsp + 0x1e0]
call fcn.1400145d0
nop
mov dword [rsp + 0xc8], 0
mov qword [rsp + 0xd8], 0
mov rdi, qword [rsp + 0x2998]
xor eax, eax
mov ecx, 0x80
rep stosb byte [rdi], al
lea rax, [rsp + 0x78]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x170]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0x138]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x170], 0x68
mov dword [rsp + 0x138], 0x18
mov qword [rsp + 0x140], 0
mov dword [rsp + 0x148], 1
xor r9d, r9d
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140425c6f
dec byte [rcx - 0x7cafdbbc]
jl 0x1400711bb
push rax
add byte [rbp + 0x50], dh
cmp qword [rsp + 0x60], 0
je 0x1400711ae
mov rcx, qword [rsp + 0x60]
call fcn.1403056d3
ret
cmp qword [rsp + 0x68], 0
je 0x1400711c1
mov rcx, qword [rsp + 0x68]
push rbx
call fcn.140583c37
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0xc0], eax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x1e0]
call fcn.1400187a0
nop
mov eax, dword [rsp + 0xc0]
jmp 0x140071852
mov rcx, qword [rsp + 0x2970]
xor rcx, rsp
call fcn.14009c290
add rsp, 0x2980
pop rdi
ret
Function at 0x14007b100
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0
jmp 0x14007b11a
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x100
jge 0x14007b1ab
mov dword [rsp + 4], 0
movsxd rax, dword [rsp]
mov rcx, qword [rsp + 0x20]
mov edx, dword [rsp]
mov dword [rcx + rax*4 + 0x90], edx
jmp 0x14007b14e
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 8
jge 0x14007b1a6
movsxd rax, dword [rsp]
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax*4 + 0x90]
and eax, 1
test eax, eax
je 0x14007b176
mov dword [rsp + 8], 0xedb88320
jmp 0x14007b17e
mov dword [rsp + 8], 0
movsxd rax, dword [rsp]
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax*4 + 0x90]
shr eax, 1
xor eax, dword [rsp + 8]
movsxd rcx, dword [rsp]
mov rdx, qword [rsp + 0x20]
mov dword [rdx + rcx*4 + 0x90], eax
jmp 0x14007b144
jmp 0x14007b112
add rsp, 0x18
ret
Function at 0x14007fdb4
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14007fe24
xor ecx, ecx
push rdi
call fcn.1405b24b1
test rax, rax
je 0x14007fe24
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007fe24
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007fe24
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007fe24
cmp dword [rcx + 0x84], 0xe
jbe 0x14007fe24
cmp dword [rcx + 0xf8], esi
je 0x14007fe24
mov ecx, r14d
call fcn.14007ff6c
mov ecx, 2
call fcn.140088ee0
nop
cmp byte [0x14020a398], 0
jne 0x14007feee
mov r15d, 1
mov eax, r15d
xchg dword [0x14020a388], eax
test ebx, ebx
jne 0x14007fe97
mov rdi, qword [0x1402008c8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14020a390]
cmp rcx, rax
je 0x14007fe8e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14007ed54]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14020a4e8]
jmp 0x14007fea3
cmp ebx, r15d
jne 0x14007fea9
lea rcx, [0x14020a500]
call fcn.140085768
nop
test ebx, ebx
jne 0x14007fec0
lea rdx, [0x1400a97f0]
lea rcx, [0x1400a97d0]
call fcn.140085a90
lea rdx, [0x1400a9800]
lea rcx, [0x1400a97f8]
call fcn.140085a90
movzx eax, byte [0x14020a398]
test esi, esi
cmove eax, r15d
mov byte [0x14020a398], al
jmp 0x14007feee
mov ecx, 2
call fcn.140088f34
test esi, esi
jne 0x14007ff05
mov ecx, r14d
call fcn.14007ff20
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14007fdb4

Function at 0x14007ff6c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov edi, ecx
lea rdx, [0x1400ae620]
xor ecx, ecx
call fcn.1403ace3c
and eax, 0x2774c085
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1400ae638]
call fcn.14049e563
jrcxz 0x14007fff1
mov ebx, eax
test rax, rax
je 0x14007ffbd
mov rcx, rax
call qword [fcn.14007ed54]
mov ecx, edi
call rbx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14007ffcd
call fcn.1402ac5ea
push rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
sal byte [rbx], cl
leave
Function at 0x140080050
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14007fe24
xor ecx, ecx
push rdi
call fcn.1405b24b1
test rax, rax
je 0x14007fe24
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007fe24
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007fe24
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007fe24
cmp dword [rcx + 0x84], 0xe
jbe 0x14007fe24
cmp dword [rcx + 0xf8], esi
je 0x14007fe24
mov ecx, r14d
call fcn.14007ff6c
mov ecx, 2
call fcn.140088ee0
nop
cmp byte [0x14020a398], 0
jne 0x14007feee
mov r15d, 1
mov eax, r15d
xchg dword [0x14020a388], eax
test ebx, ebx
jne 0x14007fe97
mov rdi, qword [0x1402008c8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14020a390]
cmp rcx, rax
je 0x14007fe8e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14007ed54]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14020a4e8]
jmp 0x14007fea3
cmp ebx, r15d
jne 0x14007fea9
lea rcx, [0x14020a500]
call fcn.140085768
nop
test ebx, ebx
jne 0x14007fec0
lea rdx, [0x1400a97f0]
lea rcx, [0x1400a97d0]
call fcn.140085a90
lea rdx, [0x1400a9800]
lea rcx, [0x1400a97f8]
call fcn.140085a90
movzx eax, byte [0x14020a398]
test esi, esi
cmove eax, r15d
mov byte [0x14020a398], al
jmp 0x14007feee
mov ecx, 2
call fcn.140088f34
test esi, esi
jne 0x14007ff05
mov ecx, r14d
call fcn.14007ff20
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14007fdb4
Function at 0x1405a3a78
Capabilities:
Encode data using base64

Disassembly:
jmp 0x14054eaae
jmp 0x1404d273b
mov dword [rsp + 0x20], 0
jmp fcn.140219626
lea rcx, [rcx*8 + 0x5d60d77d]
movsx cx, dl
mov byte [rsp + 0x24], 0
seto cl
lea rcx, [rsi + 0x114254e1]
mov rcx, qword [rsp + 0x258]
jmp 0x14021ff11
jmp loc.140028d87
mov dword [rsp + 0x30], eax
jmp 0x14047bc98
mov rcx, qword [rsp + 0x258]
jmp 0x1402d449d
jmp 0x14053a46e
jmp 0x1402fa6fd
call fcn.14001ee90
jmp 0x1403886eb
bt rdx, 0x3d
cmp ecx, 0x2e154848
bt cx, 4
mov dword [rsp + 0x20], r9d
cmc
mov qword [rsp + 0x18], r8
clc
mov qword [rsp + 0x10], rdx
test al, bh
cmc
mov qword [rsp + 8], rcx
stc
jmp 0x140562d82
call fcn.14001ee90
jmp 0x1403269c3
stc
dec cx
sub rsp, 0x248
not cx
mov cx, sp
not cx
mov qword [rsp + 0x38], 0xfffffffffffffffe
movzx cx, al
movzx cx, dl
lea rcx, [rbx*2 - 0x14c9a6de]
mov byte [rsp + 0x24], 0
setbe ch
jmp 0x1403fa652
test bx, 0x209c
bt rdx, rdx
jb 0x140401cd2
cmc
mov dword [rsp + 0x20], r9d
stc
cmc
stc
mov qword [rsp + 0x18], r8
test sp, di
clc
mov qword [rsp + 0x10], rdx
bt bp, dx
mov qword [rsp + 8], rcx
or rcx, 0xffffffffa96128bc
dec ecx
xor ch, dh
shrd rcx, rdi, 0x11
sub rsp, 0x248
lea rcx, [riz*8 + 0x4a7b7f0d]
mov qword [rsp + 0x38], 0xfffffffffffffffe
jmp 0x1403243c2
Function at 0x14012bc70
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5CoreVBox.dll_public:_void___cdecl_QFileInfo::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5CoreVBox.dll_public:_class_QString___cdecl_QFileInfo::absolutePath_void____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5CoreVBox.dll_public:_static_class_QString___cdecl_QDir::toNativeSeparators_class_QString_const____ptr64_]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5CoreVBox.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5CoreVBox.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.explore
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg bl
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5CoreVBox.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5CoreVBox.dll_public:_void___cdecl_QFileInfo::destructor_void____ptr64]
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x140144650
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x14014468d
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.1401448a0
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14014478c
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1401448a0
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x140144700
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.140005980
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x1401447cb
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401447cb
call fcn.14013f720
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x1401447b2
mov rcx, r14
call fcn.14013f720
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x14000b0b0
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002cd28]
test rcx, rcx
je 0x14000b0eb
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b0de
mov rcx, qword [0x14002cd28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002cd28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140030d78], 0
je 0x14000b1de
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140025998]
mov qword [rsp + 0x80], rsi
lea rsi, [0x14002cd50]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b1bf
test al, 0x10
je 0x14000b1bf
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b165
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x100010840
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x10044c690], ecx
xor eax, eax
add eax, 1
lea rdx, [0x10044c690]
movsxd rcx, eax
mov r8d, dword [rdx + rcx*4 - 4]
mov ecx, r8d
shr ecx, 0x1e
xor ecx, r8d
imul ecx, ecx, 0x6c078965
mov r8d, eax
add r8d, ecx
mov ecx, eax
mov dword [rdx + rcx*4], r8d
cmp eax, 0x26f
jl 0x100010848
mov dword [0x1002b73d0], 0x270
ret

Function at 0x100010890
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0xffffffff
nop dword [rax]
add eax, 1
movsxd rdx, eax
lea rcx, [0x10044c690]
mov ecx, dword [rcx + rdx*4 + 4]
mov edx, eax
lea r8, [0x10044c690]
mov r8d, dword [r8 + rdx*4]
mov edx, ecx
and edx, 1
neg rdx
and edx, 0x9908b0df
and r8d, 0x80000000
and ecx, 0x7fffffff
or r8d, ecx
shr r8d, 1
xor edx, r8d
movsxd rcx, eax
lea r8, [0x10044c690]
xor edx, dword [r8 + rcx*4 + 0x634]
mov ecx, eax
lea r8, [0x10044c690]
mov dword [r8 + rcx*4], edx
cmp eax, 0xe2
jl 0x100010898
mov eax, 0xe2
nop dword [rax]
add eax, 1
movsxd rdx, eax
lea rcx, [0x10044c690]
mov ecx, dword [rcx + rdx*4 + 4]
mov edx, eax
lea r8, [0x10044c690]
mov r8d, dword [r8 + rdx*4]
mov edx, ecx
and edx, 1
neg rdx
and edx, 0x9908b0df
and r8d, 0x80000000
and ecx, 0x7fffffff
or r8d, ecx
shr r8d, 1
xor edx, r8d
movsxd rcx, eax
lea r8, [0x10044c690]
xor edx, dword [r8 + rcx*4 - 0x38c]
mov ecx, eax
lea r8, [0x10044c690]
mov dword [r8 + rcx*4], edx
cmp eax, 0x26e
jl 0x100010908
mov edx, dword [0x10044c690]
mov ecx, dword [0x10044d04c]
mov eax, edx
and eax, 1
neg rax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10044ccc0]
mov dword [0x10044d04c], eax
mov dword [0x1002b73d0], 0
ret

Function at 0x1000109c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
lea rsp, [rsp - 0x20]
mov ebx, dword [0x1002b73d0]
add dword [0x1002b73d0], 1
mov eax, dword [0x10044b020]
cmp eax, dword [0x1002b6b70]
jne 0x1000109e9
cmp ebx, 0x271
jb 0x100010a0c
mov ecx, dword [0x10044b020]
call fcn.100010840
not dword [0x10044b020]
mov eax, dword [0x10044b020]
mov dword [0x1002b6b70], eax
mov ebx, 0x270
nop
cmp ebx, 0x270
jne 0x100010a28
call fcn.100010890
xor ebx, ebx
mov dword [0x1002b73d0], 1
nop dword [rax]
and ebx, ebx
lea rax, [0x10044c690]
mov edx, dword [rax + rbx*4]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
nop
lea rsp, [rsp + 0x20]
pop rbx
ret
Function at 0x100012bd0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov ax, word [0x1002b68c0]
cmp ax, 0xcb
je 0x100012d0c
cmp ax, 0xcc
je 0x100012d0c
nop
mov rax, qword [0x10044d390]
test rax, rax
je 0x100012c0d
mov ecx, dword [0x10044d180]
call rax
mov rbx, rax
jmp 0x100012c14
lea rbx, [0x10044d188]
cmp word [0x10044d170], 0
jle 0x100012c3c
lea rcx, [0x10044d140]
call fcn.100012f60
mov rcx, rbx
call fcn.100012690
mov rcx, rbx
call fcn.100012720
nop
mov rsi, qword [rbx]
jmp 0x100012c69
mov rdi, qword [rsi + 8]
mov rax, qword [rsi]
and rax, 1
jne 0x100012c62
mov rdx, rsi
mov rcx, rbx
call fcn.100011910
jmp 0x100012c66
and qword [rsi], 0xfffffffffffffffe
mov rsi, rdi
test rsi, rsi
jne 0x100012c48
mov qword [rbx], 0
mov dword [rbx + 0x90], 0
cmp word [0x10044d170], 0
jle 0x100012d0c
lea rdx, [0x10044d050]
mov rcx, rbx
call fcn.100011a90
mov rsi, rax
test rax, rax
je 0x100012cd8
mov rax, qword [0x10044d0f0]
mov qword [rsi + 0x18], rax
cmp qword [0x10044d0f0], 0
je 0x100012cc8
mov rax, qword [0x10044d0f0]
mov qword [rax + 0x10], rsi
nop dword [rax]
mov rax, qword [rbx + 0xa0]
mov qword [0x10044d0f0], rax
nop
sub word [0x10044d170], 1
cmp word [0x10044d170], 0
sete bl
lea rcx, [0x10044d140]
call fcn.100012fa0
test bl, bl
je 0x100012d0c
lea rcx, [0x10044d140]
call fcn.100012f40
nop dword [rax]
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x100015f20
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x70]
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], r12
mov sil, cl
mov rdi, rdx
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
nop
test sil, sil
je 0x10001605e
movzx eax, sil
sub eax, 0xffffffc0
mov word [rbp - 8], ax
mov word [rbp - 6], 0x3a
mov word [rbp - 4], 0
mov word [rbp - 2], 0
lea rcx, [rbp - 8]
lea r9, [rbp - 0x10]
xor r8, r8
xor edx, edx
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
mov edx, ebx
sub rdx, 1
mov rcx, rdi
call fcn.10000c870
mov r8, qword [rdi]
test r8, r8
jne 0x100015faf
lea r8, [0x10044c460]
lea rcx, [rbp - 8]
lea r9, [rbp - 0x10]
mov edx, ebx
call sub.kernel32.dll_GetFullPathNameW
mov r12d, eax
test eax, eax
jne 0x10001601b
call sub.kernel32.dll_GetLastError
mov ecx, eax
call fcn.100003990
lea rcx, [rbp - 0x18]
call fcn.10000ae20
and esi, 0xff
lea edx, [esi + 0x41]
sub edx, 1
and edx, 0xffff
lea rcx, [rbp - 0x20]
call fcn.10000b480
mov rdx, qword [rbp - 0x20]
lea r8, [0x1002f066c]
lea rcx, [rbp - 0x18]
call fcn.10000b1e0
mov rdx, qword [rbp - 0x18]
mov rcx, rdi
call fcn.10000bf80
jmp 0x1000160b0
mov eax, ebx
sub rax, 1
mov edx, r12d
cmp rax, rdx
je 0x100016034
mov edx, r12d
mov rcx, rdi
call fcn.10000c870
cmp byte [0x1002b6b30], 0
jne 0x1000160b0
mov rdx, qword [rdi]
lea rcx, [rbp - 0x28]
call fcn.10000cee0
mov rdx, qword [rbp - 0x28]
mov rcx, rdi
call fcn.10000c0e0
nop dword [rax]
jmp 0x1000160b0
xor edx, edx
xor ecx, ecx
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
mov edx, ebx
sub rdx, 1
mov rcx, rdi
call fcn.10000c870
mov rdx, qword [rdi]
test rdx, rdx
jne 0x100016086
lea rdx, [0x10044c460]
mov ecx, ebx
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x1002b6b30], 0
jne 0x1000160b0
mov rdx, qword [rdi]
lea rcx, [rbp - 0x28]
call fcn.10000cee0
mov rdx, qword [rbp - 0x28]
mov rcx, rdi
call fcn.10000c0e0
nop
nop
mov rcx, rbp
call fcn.100015ef0
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x30]
lea rsp, [rbp]
pop rbp
ret