joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54b330
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x90
mov rbp, rsp
mov byte [rbp + 0x3f], cl
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x80], 0
nop
mov rax, qword [0x00584b48]
lea rcx, [rax + 0x80]
lea rdx, [rbp + 0x80]
call fcn.004488d0
mov rcx, 0xffffffff80000001
lea rdx, [0x0054b5a8]
lea r8, [rbp + 0x88]
call sub.advapi32.dll_RegOpenKeyW
movzx rax, byte [rbp + 0x3f]
test al, al
je 0x54b454
mov rax, qword [rbp + 0x80]
test rax, rax
je 0x54b3cd
mov rax, qword [rax - 8]
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x80]
mov r8d, eax
call fcn.00537a20
lea rcx, [rbp + 0x78]
lea rdx, [rbp + 0x68]
call fcn.00537960
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x78]
call fcn.00412120
mov rcx, qword [rbp + 0x60]
call fcn.00412150
mov rsi, rax
xor ebx, ebx
mov rax, qword [0x00584ee8]
mov rax, qword [rax]
test rax, rax
je 0x54b41d
mov ebx, dword [rax - 4]
shr ebx, 1
mov rax, qword [0x00584ee8]
mov rcx, qword [rax]
call fcn.00412150
mov rcx, qword [rbp + 0x88]
mov rdx, rsi
xor r8, r8
mov r9d, 1
mov qword [rsp + 0x20], rax
add ebx, ebx
mov dword [rsp + 0x28], ebx
call sub.advapi32.dll_RegSetValueExW
jmp 0x54b4f3
mov rax, qword [rbp + 0x80]
test rax, rax
je 0x54b464
mov rax, qword [rax - 8]
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x80]
mov r8d, eax
call fcn.00537a20
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x68]
call fcn.00537960
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.00412120
mov rcx, qword [rbp + 0x50]
call fcn.00412150
mov rsi, rax
lea rcx, [rbp + 0x48]
xor edx, edx
call fcn.00409920
mov rcx, qword [rbp + 0x48]
call fcn.004126e0
mov rbx, rax
lea rcx, [rbp + 0x40]
xor edx, edx
call fcn.00409920
mov rax, qword [rbp + 0x40]
xor ecx, ecx
test rax, rax
je 0x54b4cd
mov ecx, dword [rax - 4]
mov rax, qword [rbp + 0x88]
mov rdx, rsi
xor r8, r8
mov r9d, 1
mov qword [rsp + 0x20], rbx
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, rax
call sub.advapi32.dll_RegSetValueExW
mov rcx, qword [rbp + 0x88]
call sub.advapi32.dll_RegCloseKey
nop
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.00410ba0
lea rcx, [rbp + 0x50]
call fcn.00410b60
lea rcx, [rbp + 0x58]
call fcn.00410b10
lea rcx, [rbp + 0x60]
call fcn.00410b60
lea rcx, [rbp + 0x78]
call fcn.00410b10
lea rcx, [rbp + 0x80]
mov rdx, qword [0x00447e70]
call fcn.00415bc0
lea rsp, [rbp + 0x90]
pop rbx
pop rsi
pop rbp
ret
Function at 0x54c7e0
Capabilities:
Clear file content

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rdx
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0xa0], r8
lea rcx, [rbp + 0xa0]
call fcn.00410cd0
nop
mov al, 1
mov byte [rbp + 0x5f], al
mov bl, 1
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0xffffffffffffffff
jne 0x54c881
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0xa0]
call fcn.00448420
mov rcx, qword [rbp + 0x68]
call fcn.00412150
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
jmp 0x54c90d
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x50]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x54c8ab
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_SetEndOfFile
test eax, eax
jne 0x54c920
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0xa0]
call fcn.00448420
mov rcx, qword [rbp + 0x60]
call fcn.00412150
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
add bl, 1
cmp bl, 0xb
jne 0x54c81c
nop
xor eax, eax
mov byte [rbp + 0x5f], al
nop
lea rcx, [rbp + 0x60]
mov edx, 2
call fcn.00410c40
lea rcx, [rbp + 0xa0]
call fcn.00410b60
movzx rax, byte [rbp + 0x5f]
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x54ca20
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x38], 0
nop
mov rax, qword [rbp + 0x28]
add dword [rax], 1
lea rcx, [rbp + 0x38]
mov rax, qword [rbp + 0x28]
mov edx, dword [rax]
call fcn.00449630
mov eax, 1
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movsxd rdx, eax
lea rcx, [rcx + rdx]
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
movzx rdx, byte [rdx]
xor byte [rcx], dl
add eax, 1
cmp eax, 0x10
jne 0x54ca54
nop
xor eax, eax
movsxd r9, eax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movzx rdx, byte [rcx + r9]
mov ecx, edx
shl ecx, 4
movzx rcx, cl
shr ecx, 4
movzx r8, cl
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movzx rcx, byte [rcx + r8]
mov r10, qword [rbp + 0x20]
mov r10, qword [r10]
mov byte [r10 + r8], dl
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
mov byte [rdx + r9], cl
add eax, 1
cmp eax, 0x10
jne 0x54ca7a
nop
xor eax, eax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movsxd rdx, eax
lea rcx, [rcx + rdx]
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
movzx rdx, byte [rdx + 0xf]
xor byte [rcx], dl
add eax, 1
cmp eax, 0xf
jne 0x54cac6
nop
mov rax, qword [rbp + 0x38]
movzx rcx, byte [rax + 3]
shl ecx, 6
movzx rcx, cl
shr ecx, 6
xor eax, eax
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
movsxd r8, eax
lea rdx, [rdx + r8]
mov r8, qword [rbp + 0x38]
movzx r9, cl
movzx r8, byte [r8 + r9]
xor byte [rdx], r8b
add eax, 1
cmp eax, 0x10
jne 0x54cb00
nop
xor eax, eax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movsxd rdx, eax
lea rcx, [rcx + rdx]
mov rdx, qword [rbp + 0x38]
mov r8d, eax
and r8d, 0x80000003
jns 0x54cb53
sub r8d, 1
or r8d, 0xfffffffc
add r8d, 1
movsxd r8, r8d
movzx rdx, byte [rdx + r8]
xor byte [rcx], dl
add eax, 1
cmp eax, 0x10
jne 0x54cb29
nop
nop
lea rcx, [rbp + 0x38]
mov rdx, qword [0x00447e70]
call fcn.00415bc0
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x54d480
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rdx
mov dword [rbp + 0x5c], r8d
mov qword [rbp + 0x60], r9
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0xd0]
call fcn.00410cd0
nop
mov al, 1
mov byte [rbp + 0x6f], al
mov bl, 1
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0xffffffffffffffff
jne 0x54d534
mov ecx, dword [rbp + 0xd8]
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xd0]
call fcn.00448420
mov rcx, qword [rbp + 0x78]
call fcn.00412150
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
jmp 0x54d5f0
mov dword [rbp + 0x8c], 0
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x50]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x54d58e
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rax, qword [rbp + 0x60]
mov rdx, qword [rax]
mov r8d, dword [rbp + 0x5c]
lea r9, [rbp + 0x8c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x54d58e
mov eax, dword [rbp + 0x5c]
cmp dword [rbp + 0x8c], eax
je 0x54d603
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
mov ecx, 0x1f4
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0xd0]
call fcn.00448420
mov rcx, qword [rbp + 0x70]
call fcn.00412150
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
add bl, 1
cmp bl, 0xb
jne 0x54d4ce
nop
xor eax, eax
mov byte [rbp + 0x6f], al
nop
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.00410c40
lea rcx, [rbp + 0xd0]
call fcn.00410b60
movzx rax, byte [rbp + 0x6f]
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x54d950
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rdx
mov dword [rbp + 0x5c], r8d
mov qword [rbp + 0x60], r9
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0xd0]
call fcn.00410cd0
nop
mov al, 1
mov byte [rbp + 0x6f], al
mov bl, 1
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0xffffffffffffffff
jne 0x54da03
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xd0]
call fcn.00448420
mov rcx, qword [rbp + 0x78]
call fcn.00412150
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
jmp 0x54dabf
mov dword [rbp + 0x8c], 0
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x50]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x54da5d
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rax, qword [rbp + 0x60]
mov rdx, qword [rax]
mov r8d, dword [rbp + 0x5c]
lea r9, [rbp + 0x8c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x54da5d
mov eax, dword [rbp + 0x5c]
cmp dword [rbp + 0x8c], eax
je 0x54dad2
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0xd0]
call fcn.00448420
mov rcx, qword [rbp + 0x70]
call fcn.00412150
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
add bl, 1
cmp bl, 0xb
jne 0x54d99e
nop
xor eax, eax
mov byte [rbp + 0x6f], al
nop
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.00410c40
lea rcx, [rbp + 0xd0]
call fcn.00410b60
movzx rax, byte [rbp + 0x6f]
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x54ddd0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov dword [rbp + 0x48], r9d
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0xa8], rdx
mov qword [rbp + 0xb0], r8
lea rcx, [rbp + 0xa8]
call fcn.00410cd0
lea rcx, [rbp + 0xb0]
call fcn.00410cd0
nop
mov al, 1
mov byte [rbp + 0x4f], al
mov eax, dword [rbp + 0x48]
cmp eax, 0xffffffff
jne 0x54deb1
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb0]
call fcn.00412200
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x80]
call fcn.00448420
mov rcx, qword [rbp + 0x88]
call fcn.00412150
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
cmp eax, 0xffffffff
jne 0x54deb1
mov eax, 0x80
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
and eax, 1
cmp eax, 1
jne 0x54df7c
mov eax, dword [rbp + 0x48]
and eax, 0xfffffffe
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
test eax, eax
jne 0x54ded8
mov eax, 0x80
mov dword [rbp + 0x48], eax
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb0]
call fcn.00412200
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
call fcn.00448420
mov rcx, qword [rbp + 0x78]
call fcn.00412150
mov rcx, rax
mov edx, dword [rbp + 0x48]
call sub.kernel32.dll_SetFileAttributesW
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb0]
call fcn.00412200
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.00448420
mov rcx, qword [rbp + 0x68]
call fcn.00412150
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x40]
mov qword [rcx], rax
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0xffffffffffffffff
jne 0x54dfec
jmp 0x54dfe6
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb0]
call fcn.00412200
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.00448420
mov rcx, qword [rbp + 0x58]
call fcn.00412150
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x40]
mov qword [rcx], rax
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0xffffffffffffffff
jne 0x54dfec
xor eax, eax
mov byte [rbp + 0x4f], al
nop
lea rcx, [rbp + 0x50]
mov edx, 8
call fcn.00410c40
lea rcx, [rbp + 0xa8]
mov edx, 2
call fcn.00410c40
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x54e240
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x70], rcx
lea rcx, [rbp + 0x70]
call fcn.00410cd0
nop
or rax, 0xffffffffffffffff
mov qword [rbp + 0x20], rax
mov bl, 0xa
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x70]
call fcn.0054e060
mov rcx, qword [rbp + 0x28]
call fcn.00412150
mov rcx, rax
lea rdx, [rbp + 0x48]
lea r8, [rbp + 0x38]
lea r9, [rbp + 0x40]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x54e2a1
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x20], rax
jmp 0x54e2b4
mov ecx, 0x64
call sub.kernel32.dll_Sleep
sub bl, 1
test bl, bl
jne 0x54e269
nop
nop
lea rcx, [rbp + 0x28]
call fcn.00410b60
lea rcx, [rbp + 0x70]
call fcn.00410b60
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret
Function at 0x54e350
Capabilities:
Delete file
Get file size
Move file

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x90
mov rbp, rsp
mov dword [rbp + 0x2c], r8d
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rdx
lea rcx, [rbp + 0xb0]
call fcn.00410cd0
lea rcx, [rbp + 0xb8]
call fcn.00410cd0
nop
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xb8]
mov r9d, dword [rbp + 0x2c]
call fcn.0054ddd0
test al, al
je 0x54e566
mov rcx, qword [rbp + 0x88]
lea rdx, [rbp + 0x78]
call sub.kernel32.dll_GetFileSizeEx
test eax, eax
jne 0x54e40b
mov rcx, qword [rbp + 0x88]
call sub.kernel32.dll_CloseHandle
jmp 0x54e566
mov rcx, qword [rbp + 0x78]
lea rdx, [rbp + 0x87]
call fcn.0054e330
xor ebx, ebx
movzx rax, byte [rbp + 0x87]
sub al, 1
cmp al, 0xff
je 0x54e43a
test al, al
je 0x54e44a
sub al, 1
test al, al
jne 0x54e470
jmp 0x54e45e
lea rcx, [rbp + 0x88]
call fcn.0054c260
mov ebx, eax
jmp 0x54e470
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x78]
call fcn.0054c290
mov ebx, eax
jmp 0x54e470
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x78]
call fcn.0054c310
mov ebx, eax
mov rcx, qword [rbp + 0x88]
call sub.kernel32.dll_CloseHandle
test bl, bl
jne 0x54e48b
cmp qword [rbp + 0x78], 0
jne 0x54e566
mov dword [rbp + 0x68], 1
mov dword [rbp + 0x6c], 0
mov rcx, qword [rbp + 0x88]
lea rdx, [rbp + 0x68]
lea r8, [rbp + 0x68]
lea r9, [rbp + 0x68]
call sub.kernel32.dll_SetFileTime
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0xb0]
call fcn.0054c3a0
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xb8]
call fcn.00412200
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.00448420
mov rcx, qword [rbp + 0x58]
call fcn.00412150
mov rsi, rax
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0x70]
call fcn.00412200
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
call fcn.00448420
mov rcx, qword [rbp + 0x48]
call fcn.00412150
mov rcx, rsi
mov rdx, rax
call sub.kernel32.dll_MoveFileW
test eax, eax
je 0x54e566
cmp bl, 2
jne 0x54e565
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0x70]
call fcn.00412200
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.00448420
mov rcx, qword [rbp + 0x38]
call fcn.00412150
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
test eax, eax
je 0x54e566
nop
lea rcx, [rbp + 0x30]
mov edx, 6
call fcn.00410c40
lea rcx, [rbp + 0x70]
call fcn.00410b60
lea rcx, [rbp + 0xb0]
mov edx, 2
call fcn.00410c40
lea rsp, [rbp + 0x90]
pop rbx
pop rsi
pop rbp
ret
Function at 0x5544f0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x28
mov cx, 0x101
mov rax, qword [0x00584b48]
lea rdx, [rax + 0x150]
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x55451d
mov rax, qword [0x00584b48]
mov byte [rax + 0x12c], 1
add rsp, 0x28
ret
Function at 0x180007c60
Capabilities:
Create thread
Parse pe header

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x18005e010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rcx
cmp edx, 1
jne 0x180007d23
mov eax, 0x5a4d
mov dword [rsp + 0x30], 0
cmp word [rcx], ax
jne 0x180007cf0
movsxd rax, dword [rcx + 0x3c]
shl rax, 6
cmp dword [rax + rcx], 0x4550
jne 0x180007cf0
movzx ecx, word [rax + rcx + 0x14]
test cx, cx
je 0x180007cf0
lea r8d, [rdx + 0x3f]
mov qword [rsp + 0x58], rbx
mov ebx, ecx
lea r9, [rsp + 0x30]
mov edx, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x28], 0
lea r8, [0x180007570]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180007d23
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18004a7f0
add rsp, 0x40
pop rdi
ret
Function at 0x18000bde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x18000bf74
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x18000bf74
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x18000be7b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x18000bf9b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x18000be92
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x18000be92
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x18000bea5
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x18000bef2
mov r8d, eax
cmp eax, 0x800
jae 0x18000bebf
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x18000bef2
cmp eax, 0x10000
jae 0x18000bed9
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x18000bef2
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x18000bf74
add qword [r14], 2
test sil, sil
jne 0x18000bf13
cmp r10d, 3
jae 0x18000bf1f
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x18000bf51
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x18000bf30
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x18000be2f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x18000bf82
Function at 0x180010490
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1800104ed
lea rbx, [0x18004da40]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1800104d4
cmp r10, 2
jb 0x1800104d4
cmp byte [r9], r8b
jne 0x1800104d4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1800104b0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18001052f
lea rbx, [0x18004da40]
cmp r8b, 0x23
jne 0x180010513
cmp byte [r9], r8b
jne 0x180010513
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180010500
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180010710
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18001072a
mov qword [r8], 0
lea rdx, [0x180054520]
call fcn.180010540
mov rbx, rax
test rax, rax
jne 0x18001074a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180010835
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180010835
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180010835
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180010835
cmp rdi, 0xffffffffffffffff
je 0x180010835
mov rax, qword [0x18005eed0]
test rax, rax
je 0x1800107c6
inc dword [rax + 0x3bc]
mov rdx, qword [0x18005eec8]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rax, rax
je 0x180010835
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180010822
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18005eed0]
test rax, rax
je 0x180010811
dec dword [rax + 0x3bc]
mov rdx, qword [0x18005eec8]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x18001083e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x180010830
mov qword [r14], rdi
mov rax, rsi
jmp 0x180010840
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret