joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016a30
Capabilities:
Copy file

Disassembly:
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xd8], rbx
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movzx edi, r8b
mov rbx, rdx
lea rdx, [rsp + 0x50]
call fcn.1400222a0
nop
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400222a0
nop
lea rcx, [rsp + 0x50]
call fcn.140026e10
cmp eax, 0x104
jl 0x140016ab5
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.140023c00
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14001d690
nop
lea rcx, [rsp + 0x78]
call fcn.14001d440
lea rcx, [rsp + 0x28]
call fcn.140026e10
cmp eax, 0x104
jl 0x140016aee
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x28]
call fcn.140023c00
nop
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14001d690
nop
lea rcx, [rsp + 0x78]
call fcn.14001d440
movzx edi, dil
lea rcx, [rsp + 0x28]
call fcn.14002aa20
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.14002aa20
mov rcx, rax
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
lea rcx, [rsp + 0x28]
call fcn.14001d440
nop
lea rcx, [rsp + 0x50]
call fcn.14001d440
movzx eax, bl
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0xd8]
add rsp, 0xb0
pop rdi
ret

Function at 0x140016b60
Capabilities:
Clear file content

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rdx
lea rdx, [r11 - 0x38]
call fcn.140020c90
nop
test rbx, rbx
jg 0x140016ba6
mov ebx, 0xffffff9c
jmp 0x140016c2f
lea rcx, [rsp + 0x50]
call fcn.14002aa20
mov rcx, rax
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140016c2a
xor r9d, r9d
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140016c1a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebx, 0xfffffffd
test eax, eax
cmovne ebx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140016c2f
mov ebx, 0xfffffffb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140016c2f
mov ebx, 0xfffffff7
lea rcx, [rsp + 0x50]
call fcn.14001d440
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140283120
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140016cc0
Capabilities:
Delete directory

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x190
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rdx
xor ebx, ebx
mov qword [rdx], rbx
lea rdx, [r11 - 0x50]
call fcn.140020c90
nop
xor edx, edx
lea rcx, [rsp + 0x158]
call fcn.14001f4b0
lea rcx, [rsp + 0x30]
call fcn.14004c020
nop
mov byte [rsp + 0x30], 1
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x30]
call fcn.14004cd60
lea rcx, [rsp + 0x30]
call fcn.14004d840
mov ebp, ebx
mov rcx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
sub rcx, r8
movabs r14, 0x4924924924924925
mov rax, r14
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x140016dec
mov eax, ebx
mov esi, ebx
imul rcx, rax, 0x70
add rcx, r8
cmp byte [rsi + r8 + 0x6c], 0
je 0x140016e38
lea rdx, [rsp + 0x130]
call fcn.140020c90
nop
lea rcx, [rsp + 0x130]
call fcn.14002aa20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
lea rcx, [rsp + 0x130]
test eax, eax
je 0x140016e2f
call fcn.14001d440
inc qword [rdi]
inc ebp
add rsi, 0x70
mov rcx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
sub rcx, r8
mov rax, r14
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, ebp
cmp rax, rdx
jb 0x140016d71
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x158]
call fcn.140020c90
nop
lea rcx, [rsp + 0x130]
call fcn.14002aa20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
lea rcx, [rsp + 0x130]
test eax, eax
je 0x140016e4c
call fcn.14001d440
inc qword [rdi]
jmp 0x140016e53
call fcn.14001d440
inc ebx
jmp 0x140016dbd
call fcn.140018e60
test eax, eax
je 0x140016dba
inc ebx
jmp 0x140016dbd
call fcn.14001d440
inc ebx
lea rcx, [rsp + 0x30]
call fcn.1400154a0
nop
lea rcx, [rsp + 0x158]
call fcn.14001d440
mov eax, ebx
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140283120
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140016ea0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
call fcn.140018c30
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140016ec0

Function at 0x140016ec0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x28]
call fcn.1400222a0
nop
lea rcx, [rsp + 0x28]
call fcn.140026e10
cmp eax, 0x104
jl 0x140016f25
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140023dd0
nop
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14001d690
nop
lea rcx, [rsp + 0x50]
call fcn.14001d440
lea rcx, [rsp + 0x28]
call fcn.14002aa20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
lea rcx, [rsp + 0x28]
call fcn.14001d440
movzx eax, bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140283120
add rsp, 0x80
pop rbx
ret
Function at 0x1400178e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xc8]
sub rsp, 0x1c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rbx, rcx
xor ecx, ecx
call fcn.14028c13c
mov rdi, rax
mov ecx, eax
call fcn.14028c1a8
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14001c0d0
nop
mov dl, 1
lea rcx, [rsp + 0x50]
call fcn.14001f4b0
call sub.KERNEL32.dll_GetTickCount
mov edx, eax
lea rcx, [rbp + 0x18]
call fcn.14001c660
nop
lea rdx, [0x1402d03c4]
lea rcx, [rbp - 0x10]
call fcn.14001c950
nop
call fcn.14004ba30
mov edx, eax
lea rcx, [rbp - 0x38]
call fcn.14001c660
nop
lea rdx, [0x1402d03c4]
lea rcx, [rbp - 0x60]
call fcn.14001c950
nop
mov edx, edi
lea rcx, [rsp + 0x78]
call fcn.14001c660
nop
lea rdx, str.TestCW.
lea rcx, [rsp + 0x28]
call fcn.14001c840
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.14001d850
mov rcx, rax
lea rdx, [rsp + 0x78]
call fcn.14001d850
mov rcx, rax
lea rdx, [rbp - 0x60]
call fcn.14001d850
mov rcx, rax
lea rdx, [rbp - 0x38]
call fcn.14001d850
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.14001d850
mov rcx, rax
lea rdx, [rbp + 0x18]
call fcn.14001d850
nop
lea rcx, [rsp + 0x28]
call fcn.14001d440
nop
lea rcx, [rsp + 0x78]
call fcn.14001d440
nop
lea rcx, [rbp - 0x60]
call fcn.14001d440
nop
lea rcx, [rbp - 0x38]
call fcn.14001d440
nop
lea rcx, [rbp - 0x10]
call fcn.14001d440
nop
lea rcx, [rbp + 0x18]
call fcn.14001d440
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1400222a0
nop
lea rcx, [rsp + 0x28]
call fcn.14002aa20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140017aef
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rcx, [rsp + 0x28]
call fcn.14001d440
lea rcx, [rbp + 0x40]
call fcn.140034f00
nop
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.140034f30
lea rcx, [rbp + 0x40]
call fcn.140034a70
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1400222a0
nop
lea rcx, [rsp + 0x28]
call fcn.14002aa20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140017acd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rcx, [rsp + 0x28]
call fcn.14001d440
xor bl, bl
jmp 0x140017ad9
lea rcx, [rsp + 0x28]
call fcn.14001d440
mov bl, 1
lea rcx, [rsp + 0x50]
call fcn.140016ec0
nop
lea rcx, [rbp + 0x40]
call fcn.140034f20
jmp 0x140017b06
lea rcx, [rsp + 0x28]
call fcn.14001d440
lea rcx, [rsp + 0x50]
call fcn.140016ec0
movzx ebx, al
lea rcx, [rsp + 0x50]
call fcn.14001d440
movzx eax, bl
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140283120
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140017fb0
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0xb0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rdx
lea rdx, [rsp + 0x50]
call fcn.1400222a0
nop
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400222a0
nop
lea rcx, [rsp + 0x50]
call fcn.140026e10
cmp eax, 0x104
jl 0x140018029
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.140023c00
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14001d690
nop
lea rcx, [rsp + 0x78]
call fcn.14001d440
lea rcx, [rsp + 0x28]
call fcn.140026e10
cmp eax, 0x104
jl 0x140018062
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x28]
call fcn.140023c00
nop
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14001d690
nop
lea rcx, [rsp + 0x78]
call fcn.14001d440
lea rcx, [rsp + 0x28]
call fcn.14002aa20
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.14002aa20
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
lea rcx, [rsp + 0x28]
call fcn.14001d440
nop
lea rcx, [rsp + 0x50]
call fcn.14001d440
movzx eax, bl
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140283120
add rsp, 0xb0
pop rbx
ret
Function at 0x140018b10
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x78], rax
movzx edi, dl
lea rdx, [rsp + 0x28]
call fcn.1400222a0
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.1400222a0
nop
lea rcx, [rsp + 0x50]
call fcn.14002aa20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140018b87
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rcx, [rsp + 0x50]
call fcn.14001d440
mov ebx, 0xffffffff
jmp 0x140018c05
lea rcx, [rsp + 0x50]
call fcn.14001d440
lea rcx, [rsp + 0x28]
call fcn.14002aa20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140018bb2
mov ebx, 0xffffff9c
jmp 0x140018c05
test dil, dil
je 0x140018bdd
test bl, 2
jne 0x140018c03
or ebx, 2
lea rcx, [rsp + 0x28]
call fcn.14002aa20
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140018c03
lea ebx, [rax - 2]
jmp 0x140018c05
test bl, 2
je 0x140018c03
and ebx, 0xfffffffd
lea rcx, [rsp + 0x28]
call fcn.14002aa20
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140018c03
lea ebx, [rax - 3]
jmp 0x140018c05
xor ebx, ebx
lea rcx, [rsp + 0x28]
call fcn.14001d440
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret

Function at 0x140018c30
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x78], rax
movzx edi, dl
lea rdx, [rsp + 0x28]
call fcn.1400222a0
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.1400222a0
nop
lea rcx, [rsp + 0x50]
call fcn.14002aa20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140018ca7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rcx, [rsp + 0x50]
call fcn.14001d440
mov ebx, 0xffffffff
jmp 0x140018d25
lea rcx, [rsp + 0x50]
call fcn.14001d440
lea rcx, [rsp + 0x28]
call fcn.14002aa20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140018cd2
mov ebx, 0xffffff9c
jmp 0x140018d25
test dil, dil
je 0x140018cfd
test bl, 1
jne 0x140018d23
or ebx, 1
lea rcx, [rsp + 0x28]
call fcn.14002aa20
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140018d23
lea ebx, [rax - 2]
jmp 0x140018d25
test bl, 1
je 0x140018d23
and ebx, 0xfffffffe
lea rcx, [rsp + 0x28]
call fcn.14002aa20
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140018d23
lea ebx, [rax - 3]
jmp 0x140018d25
xor ebx, ebx
lea rcx, [rsp + 0x28]
call fcn.14001d440
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x140019320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x158], rbx
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rbp + 0x30], rax
lea rdx, [rbp - 0x20]
call fcn.1400222a0
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x20]
call fcn.1400222a0
nop
lea rcx, [rbp - 0x48]
call fcn.14002aa20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140019395
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rcx, [rbp - 0x48]
call fcn.14001d440
mov ebx, 0xffffffff
jmp 0x140019575
lea rcx, [rbp - 0x48]
call fcn.14001d440
movdqa xmm0, xmmword [0x1402d0510]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov r8d, SQLFreeStmt
lea rdx, str.WinVerifyTrust
lea rcx, [rbp - 0x48]
call fcn.140004c40
nop
lea rdx, str.Wintrust.dll
lea rcx, [rbp + 8]
call fcn.14001c840
nop
lea r8, [rbp - 0x48]
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x20]
call fcn.14004ba50
nop
lea rcx, [rbp + 8]
call fcn.14001d440
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14001942f
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001942a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001959d
call fcn.140283144
movdqa xmm0, xmmword [0x1402d0510]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
cmp qword [rsp + 0x20], 0
jne 0x140019452
mov ebx, 0xffffff9c
jmp 0x14001956a
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], 0x20
lea rcx, [rbp - 0x20]
call fcn.14002aa20
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rbp - 0x58], 0xaac56b
mov dword [rbp - 0x54], 0x11d0cd44
mov dword [rbp - 0x50], 0xc000c28c
mov dword [rbp - 0x4c], 0xee95c24f
xor ebx, ebx
mov qword [rsp + 0x50], 0x50
mov qword [rsp + 0x70], 1
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x68], 0x100
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 2
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x58]
xor ecx, ecx
call qword [rsp + 0x20]
cmp eax, 0x800b0101
jg 0x14001954c
je 0x14001956a
cmp eax, 0x80092026
je 0x140019545
cmp eax, 0x800b0004
je 0x14001953e
cmp eax, 0x800b0100
jne 0x14001955e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x800b0100
je 0x140019537
cmp eax, 0x800b0003
je 0x140019537
cmp eax, 0x800b0001
je 0x140019537
mov ebx, 0xfffffffd
jmp 0x14001956a
mov ebx, 0xfffffffe
jmp 0x14001956a
mov ebx, 0xfffffffb
jmp 0x14001956a
mov ebx, 0xfffffffa
jmp 0x14001956a
cmp eax, 0x800b010a
je 0x14001956a
cmp eax, 0x800b0111
je 0x140019565
test eax, eax
je 0x14001956a
mov ebx, 0xfffffff9
jmp 0x14001956a
mov ebx, 0xfffffffc
lea rcx, [rsp + 0x20]
call fcn.14004bab0
nop
lea rcx, [rbp - 0x20]
call fcn.14001d440
mov eax, ebx
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rbp
ret
call fcn.140287d84
nop
int3
Function at 0x14001b500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r13, r9
movzx r12d, r8b
mov rsi, rdx
mov rax, qword [rcx]
mov qword [rsp + 0x30], rax
mov r14, rax
mov rbx, qword [rax + 8]
mov dil, 1
lea r15, [r9 + 8]
cmp byte [rbx + 0x19], 0
jne 0x14001b59f
nop word [rax + rax]
mov r14, rbx
test r12b, r12b
je 0x14001b56f
lea rcx, [rbx + 0x28]
mov rdx, r15
call fcn.14001f190
mov edi, eax
shr edi, 0x1f
xor dil, 1
jmp 0x14001b581
lea rdx, [rbx + 0x28]
mov rcx, r15
call fcn.14001f190
shr eax, 0x1f
movzx edi, al
test dil, dil
je 0x14001b58b
mov rbx, qword [rbx]
jmp 0x14001b58f
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x19], 0
je 0x14001b550
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x30]
mov rbx, r14
mov qword [rsp + 0x30], rbx
test dil, dil
je 0x14001b5f0
cmp r14, qword [rax]
jne 0x14001b5e1
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r13
mov r9, r14
mov r8b, 1
lea rdx, [rsp + 0x70]
call fcn.14001ae10
mov rax, qword [rax]
mov qword [rsi], rax
mov byte [rsi + 8], 1
mov rax, rsi
jmp 0x14001b643
lea rcx, [rsp + 0x30]
call fcn.140007b60
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx + 0x28]
mov rdx, r15
call fcn.14001f190
shr eax, 0x1f
test al, al
je 0x14001b639
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r13
mov r9, r14
movzx r8d, dil
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call fcn.14001ae10
mov rax, qword [rax]
mov qword [rsi], rax
mov byte [rsi + 8], 1
mov rax, rsi
jmp 0x14001b643
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14001f470
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x20
movzx eax, byte [section.Shared]
mov rbx, rcx
test al, al
je 0x14001f499
call fcn.140051840
mov rcx, rax
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140051850
add rsp, 0x20
pop rbx
ret
Function at 0x1400222a0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x880
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x8b0], rbx
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rsi, rdx
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x30]
call fcn.140020c90
nop
xor edx, edx
mov r8d, 0x802
lea rcx, [rsp + 0x60]
call fcn.140285450
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
mov r8d, 0x400
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rbp, vtable.HString.0
xor edi, edi
mov qword [rsi], rbp
test eax, eax
je 0x140022368
lea rcx, [rsi + 8]
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov word [rcx], di
inc dword [0x1403b19d8]
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140022350
lea rdx, [rsp + 0x60]
call fcn.14001ecc0
nop
jmp 0x1400223b1
lea rbx, [rsi + 8]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rax, [rsp + 0x38]
cmp rbx, rax
je 0x1400223b1
mov rcx, rbx
call fcn.14001e7f0
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbx + 0x10], xmm1
movdqa xmm0, xmmword [0x1402d4290]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], di
mov qword [rsp + 0x30], rbp
dec dword [0x1403b19d8]
lea rcx, [rsp + 0x38]
call fcn.14001e7f0
mov rax, rsi
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0x8b0]
add rsp, 0x880
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002d5f0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x450
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x470], rbx
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x440], rax
movzx ebx, dl
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], 0
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x40]
call fcn.140285450
lea rdx, [rsp + 0x40]
mov ecx, 0x200
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14001c950
mov dword [rsp + 0x20], 1
movzx edx, bl
mov rcx, rdi
call fcn.14001f4b0
mov rax, rdi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
ret
Function at 0x14002e330
Capabilities:
Get common file path
Get session user name

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x570], rbx
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rbp + 0x430], rax
movzx esi, dl
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x20]
call fcn.140285450
mov dword [rsp + 0x20], 0x100
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.14001c950
nop
lea rdx, str.SYSTEM
lea rcx, [rbp - 0x58]
call fcn.14001c950
nop
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x58]
call fcn.14001f210
mov ebx, eax
lea rcx, [rbp - 0x58]
call fcn.14001d440
test ebx, ebx
je 0x14002e453
lea rdx, [0x1402d50e0]
lea rcx, [rbp - 0x30]
call fcn.14001c950
nop
xor r8d, r8d
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x58]
call fcn.14001f210
mov ebx, eax
lea rcx, [rbp - 0x30]
call fcn.14001d440
test ebx, ebx
je 0x14002e453
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call fcn.140053df0
nop
lea rdx, str.S_1_5_18
lea rcx, [rbp - 8]
call fcn.14001c950
nop
xor r8d, r8d
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x80]
call fcn.140026070
movzx ebx, al
lea rcx, [rbp - 8]
call fcn.14001d440
nop
lea rcx, [rbp - 0x80]
call fcn.14001d440
test bl, bl
je 0x14002e46e
lea rcx, [rsp + 0x58]
call fcn.14001d440
movzx edx, sil
mov rcx, rdi
call fcn.14002e560
jmp 0x14002e520
lea rcx, [rsp + 0x58]
call fcn.14001d440
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x220]
call fcn.140285450
lea rdx, [rbp + 0x220]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14002e45d
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x30]
call fcn.14001c950
nop
lea rcx, [rsp + 0x30]
call fcn.14002a4a0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14001f4b0
lea rcx, [rsp + 0x30]
call fcn.140015e70
test al, al
jne 0x14002e4e2
lea rcx, [rsp + 0x30]
call fcn.140017cd0
lea rcx, [rsp + 0x30]
call fcn.1400178e0
movzx edx, sil
test al, al
jne 0x14002e4fe
mov rcx, rdi
call fcn.14002e560
jmp 0x14002e516
lea rcx, [rsp + 0x30]
call fcn.14001f4b0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14001c050
nop
lea rcx, [rsp + 0x30]
call fcn.14001d440
mov rax, rdi
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0x570]
add rsp, 0x540
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002e610
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x250], rax
movzx ebx, dl
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], 0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140285450
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14001c950
mov dword [rsp + 0x20], 1
movzx edx, bl
mov rcx, rdi
call fcn.14001f4b0
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret