joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001276c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x14006a2c0]
test eax, eax
je 0x1400127b6
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14006a2c0]
test eax, eax
jne 0x1400127bf
call fcn.140005b6c
test eax, eax
je 0x1400127db
lea rdx, [rsp + 0x58]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1400127e3
xor eax, eax
jmp 0x14001282a
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14001280d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001280f
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140012828
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140012840
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14006d6c8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14006a2c0]
test eax, eax
je 0x14001288b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14006a2c0]
test eax, eax
jne 0x140012894
call fcn.140005b6c
test eax, eax
je 0x1400128b0
lea rdx, [rsp + 0x48]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400128b8
xor eax, eax
jmp 0x14001291d
test rbx, rbx
jne 0x1400128d8
lea rcx, str.InitCommonControlsEx
call fcn.14001258c
mov rbx, rax
test rax, rax
je 0x1400128eb
mov qword [0x14006d6c8], rax
mov rcx, rbx
call fcn.140025e94
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140012900
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140012902
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14001291b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140012a74
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor r14d, r14d
mov word [rax - 0x18], r14w
mov qword [rax + 0x10], r14
mov ebx, r14d
mov eax, dword [0x14006a2c0]
test eax, eax
je 0x140012abc
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14006a2c0]
test eax, eax
jne 0x140012ac5
call fcn.140005b6c
test eax, eax
je 0x140012ae1
lea rdx, [rsp + 0x48]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140012aeb
movzx eax, r14w
jmp 0x140012b33
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx ebx, ax
mov word [rsp + 0x20], ax
mov edi, r14d
test bx, bx
sete dil
test edi, edi
je 0x140012b14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140012b17
mov esi, r14d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x140012b30
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14001457c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x1400145ef
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140014603
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140014603
mov rcx, rax
call fcn.140025e94
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, rbp
call rdi
jmp 0x140014608
cmp dword [rcx + 8], 0
je 0x140014603
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140014608
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400175dc
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r14d, r8w
mov r15, rdx
mov r12, rcx
or r13d, 0xffffffff
movzx esi, r13w
mov word [rax - 0x38], r13w
mov rbx, qword [0x14006d858]
and qword [rax + 0x20], 0
xor edi, edi
mov eax, dword [0x14006a2c0]
test eax, eax
je 0x14001763a
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14006a2c0]
test eax, eax
jne 0x140017643
call fcn.140005b6c
test eax, eax
je 0x14001765f
lea rdx, [rsp + 0x78]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne edi, ecx
test edi, edi
jne 0x140017669
movzx eax, r13w
jmp 0x1400176da
test rbx, rbx
jne 0x140017689
lea rcx, str.GetFileTitleW
call fcn.140017548
mov rbx, rax
test rax, rax
je 0x1400176a5
mov qword [0x14006d858], rax
mov rcx, rbx
call fcn.140025e94
movzx r8d, r14w
mov rdx, r15
mov rcx, r12
call rbx
movzx esi, ax
mov word [rsp + 0x20], ax
xor ebx, ebx
cmp si, r13w
sete bl
test ebx, ebx
je 0x1400176bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1400176be
xor edi, edi
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400176d7
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, si
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14001a8f4
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14001a96e
xor r8d, r8d
call fcn.14001abb4
mov rsi, rax
test rax, rax
jne 0x14001a92a
mov eax, edi
jmp 0x14001a984
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14001a926
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14001acf0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov rbx, r9
mov r12, r8
mov r15, rdx
mov rsi, rcx
cmp qword [rcx + 0xb0], rdi
je 0x14001ad72
xor r8d, r8d
call fcn.14001abb4
mov rsi, rax
test rax, rax
je 0x14001ae0b
mov ecx, dword [rsp + 0x70]
mov r9d, 3
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
jmp 0x14001ae0b
mov ebp, dword [rsp + 0x70]
mov eax, 2
lea ecx, [rbp*2 + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140005d94
mov r14, rax
mov r8d, edi
test ebp, ebp
je 0x14001add6
mov rdx, rax
mov r8d, ebp
mov r9d, ebp
mov al, byte [rbx]
and al, 0xf
movzx ecx, al
add cx, 0x41
mov word [rdx], cx
lea rdx, [rdx + 4]
mov al, byte [rbx]
inc rbx
shr al, 4
movzx ecx, al
add cx, 0x41
mov word [rdx - 2], cx
sub r9, 1
jne 0x14001adab
lea eax, [r8 + r8]
mov word [r14 + rax*2], di
mov rax, qword [rsi]
mov rbx, qword [rax + 0x110]
mov rcx, rbx
call fcn.140025e94
mov r9, r14
mov r8, r12
mov rdx, r15
mov rcx, rsi
call rbx
mov rcx, r14
mov ebx, eax
call fcn.140005d8c
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x14001d784
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x14001d7b6
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001d7b6
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.1400224d8
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001d7c8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14001d7f3
mov r8, rdx
mov rdx, qword [rdi]
call fcn.14001457c
jmp 0x14001d86b
cmp byte [0x14006db10], 0
jne 0x14001d83a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001d82a
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x14006db08], rax
jmp 0x14001d831
mov rbx, qword [0x14006db08]
mov byte [0x14006db10], 1
jmp 0x14001d841
mov rbx, qword [0x14006db08]
test rbx, rbx
je 0x14001d85f
mov rcx, rbx
call fcn.140025e94
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
call rbx
jmp 0x14001d86b
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400269c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x430
mov rax, r8
mov edi, edx
mov rbx, rcx
mov rdx, rax
mov r8d, r9d
lea rcx, [rsp + 0x20]
call fcn.140027c70
mov r9d, dword [rsp + 0x20]
mov r10d, dword [rsp + 0x24]
test edi, edi
jle 0x140026a3f
mov r11d, edi
nop word [rax + rax]
inc r9b
lea rdx, [rsp + 0x28]
movzx r9d, r9b
lea rbx, [rbx + 1]
mov r8d, dword [rdx + r9*4]
lea rdx, [rdx + r9*4]
add r10b, r8b
movzx r10d, r10b
mov ecx, dword [rsp + r10*4 + 0x28]
mov dword [rdx], ecx
add cl, r8b
movzx eax, cl
mov dword [rsp + r10*4 + 0x28], r8d
movzx ecx, byte [rsp + rax*4 + 0x28]
xor byte [rbx - 1], cl
sub r11, 1
jne 0x140026a00
mov rbx, qword [rsp + 0x440]
add rsp, 0x430
pop rdi
ret
Function at 0x1400280f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x340
xor eax, eax
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
call fcn.140028200
test eax, eax
jne 0x140028195
mov dword [rsp + 0x38], 0x200
lea r9, [0x14004bc60]
lea r8, str.SYSTEMCurrentControlSetServices_s
mov edx, 0x80
lea rcx, [rsp + 0x240]
call fcn.1400026e0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
lea r8, str.GUID
lea rdx, [rsp + 0x240]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140028195
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1400281f0
jmp fcn.1400aee78
add rsp, 0x340
pop rdi
ret

Function at 0x140028580
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov word [rsp + 8], cx
sub rsp, 0x698
movzx eax, word [rsp + 0x6a0]
lea rcx, str.diskpt0.sys
mov qword [rsp + 0x20], rcx
mov r9d, eax
lea r8, str._c:_s
mov edx, 0x105
lea rcx, [rsp + 0x270]
call fcn.1400026e0
lea rdx, [rsp + 0x58]
movzx ecx, word [rsp + 0x6a0]
call fcn.140028750
cmp dword [rsp + 0x5c], 1
jne 0x140028616
mov dword [rsp + 0x48], 0x104
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x270]
call fcn.140028350
lea r8, [rsp + 0x480]
mov edx, 0x105
lea rcx, [rsp + 0x270]
call fcn.140030bb0
call fcn.140027e80
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20000080
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80000000
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x14002867d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x4c], eax
call fcn.140027d70
mov ecx, dword [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140028740
call fcn.140027d70
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x54]
mov r8d, 0x200
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400286e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140028740
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b0ac5
add rsp, 0x698
ret
Function at 0x140037278
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14003704c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003704c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003704c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003704c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003704c
cmp dword [rcx + 0x84], 0xe
jbe 0x14003704c
cmp dword [rcx + 0xf8], esi
je 0x14003704c
mov ecx, r14d
call fcn.140037194
mov ecx, 2
call fcn.14003edf8
nop
cmp byte [0x14006e760], 0
jne 0x140037116
mov r15d, 1
mov eax, r15d
xchg dword [0x14006e750], eax
test ebx, ebx
jne 0x1400370bf
mov rdi, qword [0x140068620]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14006e758]
cmp rcx, rax
je 0x1400370b6
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400216d0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14006e9a0]
jmp 0x1400370cb
cmp ebx, r15d
jne 0x1400370d1
lea rcx, [0x14006e9b8]
call fcn.140037f94
nop
test ebx, ebx
jne 0x1400370e8
lea rdx, [0x14004bc08]
lea rcx, [0x14004bbe8]
call fcn.140038260
lea rdx, [0x14004bc18]
lea rcx, [0x14004bc10]
call fcn.140038260
movzx eax, byte [0x14006e760]
test esi, esi
cmove eax, r15d
mov byte [0x14006e760], al
jmp 0x140037116
mov ecx, 2
call fcn.14003ee4c
test esi, esi
jne 0x14003712d
mov ecx, r14d
call fcn.140037148
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140036fdc

Function at 0x1400386e0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140038700
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400312d8
or eax, 0xffffffff
jmp 0x140038702
xor eax, eax
add rsp, 0x28
ret

Function at 0x14003f0d8
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14003f0b5
call fcn.140031348
mov dword [rax], 0x16
call fcn.140031228
or eax, 0xffffffff
jmp 0x14003f0d2
sub dword [rcx + 0x10], 1
jns 0x14003f0c4
add rsp, 0x28
jmp fcn.140040d9c
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14003f094
Function at 0x140040d9c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140040a58
call fcn.140031348
mov dword [rax], 0x16
call fcn.140031228
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140040a40
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140040a40
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140040a8a
lock or dword [rax + 0x14], 0x10
jmp 0x140040a40
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140040aa7
mov rcx, qword [rbp + 0x10]
call fcn.140045c90
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400338c0
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140040490
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140040afe
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140040a40
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140040b6a
mov rcx, qword [rbp + 0x10]
call fcn.1400338c0
cmp eax, 0xffffffff
je 0x140040b51
mov rcx, qword [rbp + 0x10]
call fcn.1400338c0
cmp eax, 0xfffffffe
je 0x140040b51
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400338c0
movsxd rdi, eax
lea rsi, [0x14006ea10]
mov rcx, rbx
sar rdi, 6
call fcn.1400338c0
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140040b58
lea rax, [0x140068b70]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140040b6a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140040ba0
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140040b9c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140040b9c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140040a43
jmp 0x140040a10
Function at 0x140040da4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140040c0a
call fcn.140031348
mov dword [rax], 0x16
call fcn.140031228
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140040bec
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140040bec
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x140040c3c
lock or dword [rax + 0x14], 0x10
jmp 0x140040bec
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140040c59
mov rcx, qword [rbp + 0x20]
call fcn.140045c90
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x140040c6e
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x140040c74
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1400338c0
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140040490
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x140040cc7
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x140040bec
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140040d33
mov rcx, qword [rbp + 0x20]
call fcn.1400338c0
cmp eax, 0xffffffff
je 0x140040d1a
mov rcx, qword [rbp + 0x20]
call fcn.1400338c0
cmp eax, 0xfffffffe
je 0x140040d1a
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1400338c0
movsxd rdi, eax
lea r15, [0x14006ea10]
mov rcx, rbx
sar rdi, 6
call fcn.1400338c0
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x140040d21
lea rax, [0x140068b70]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140040d33
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x140040d69
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140040d65
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140040d65
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x140040d87
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x140040d92
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x140040bf1
jmp 0x140040bb8
Function at 0x180024300
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180024328
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180024328
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x18002a2e0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
test edx, edx
je 0x18002a2fd
mov eax, 1
cmp edx, eax
jne 0x18002a352
mov qword [0x180075668], rcx
add rsp, 0x28
ret
cmp qword [0x180060a70], 0
je 0x18002a34d
cmp qword [0x180060a78], 8
mov qword [rsp + 0x20], rbx
lea rbx, [0x180060a60]
mov rcx, rbx
cmovae rcx, qword [0x180060a60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [0x180060a78], 8
cmovae rbx, qword [0x180060a60]
xor eax, eax
mov qword [0x180060a70], rax
mov word [rbx], ax
mov rbx, qword [rsp + 0x20]
mov eax, 1
add rsp, 0x28
ret
Function at 0x140001460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x100
xor r10d, r10d
movsxd rdi, r8d
mov eax, r10d
lea rdx, [rsp]
mov rbx, rcx
mov r9d, pe_nt_image_headers64
nop dword [rax + rax]
mov byte [rdx], al
lea rdx, [rdx + 1]
inc eax
cmp eax, r9d
jl 0x140001490
mov edx, r10d
lea rsi, [0x1400053e0]
mov r8, r10
nop word [rax + rax]
movzx r11d, byte [rsp + r8]
mov rax, r8
and eax, 0xf
movzx eax, byte [rax + rsi]
add edx, eax
add edx, r11d
and edx, 0x800000ff
jge 0x1400014d6
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
lea rcx, [rsp]
add rcx, rax
movzx eax, byte [rcx]
mov byte [rsp + r8], al
inc r8
mov byte [rcx], r11b
sub r9, 1
jne 0x1400014b0
mov eax, r10d
mov r11, rdi
test edi, edi
jle 0x140001562
nop dword [rax]
inc eax
and eax, 0x800000ff
jge 0x140001512
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
lea r8, [rsp]
add r8, rcx
movzx r9d, byte [r8]
lea ecx, [r10 + r9]
and ecx, 0x800000ff
jge 0x140001536
dec ecx
or ecx, 0xffffff00
inc ecx
movsxd r10, ecx
lea rdx, [rsp]
movzx ecx, byte [rdx + r10]
mov byte [r8], cl
mov byte [rdx + r10], r9b
movzx edx, byte [r8]
add rdx, r9
movzx ecx, dl
movzx edx, byte [rsp + rcx]
xor byte [rbx], dl
inc rbx
sub r11, 1
jne 0x140001500
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret