joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fcc50
Capabilities:
Reference sql statements

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x14033d010]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rdi, rdx
mov qword [rsp + 0x30], rdx
xor esi, esi
mov dword [rsp + 0x20], esi
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x18], 0xf
mov byte [rdx], sil
mov dword [rsp + 0x20], 1
lea rbx, [rcx + 0x328]
mov rdx, r8
lea rcx, [rsp + 0x98]
call fcn.14008d690
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140080f00
nop
lea r9d, [rsi + 0x31]
lea r8, str.SELECT_comment_FROM__Preset_Id__WHERE_file_path
xor edx, edx
mov rcx, rax
call fcn.140069240
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
lea rdx, [0x14029d530]
lea rcx, [rsp + 0x58]
call fcn.14007a550
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
mov dword [rsp + 0x20], 7
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x28]
lea r8, [0x1400c9590]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140080c10
nop
lea rcx, [rsp + 0x38]
call fcn.14004f4d0
nop
lea rcx, [rsp + 0x58]
call fcn.14004f4d0
nop
lea rcx, [rsp + 0x78]
call fcn.14004f4d0
nop
lea rcx, [rsp + 0x98]
call fcn.14004f4d0
mov rax, rdi
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14022d970
add rsp, 0xc0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400fdb80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbx
push rdi
sub rsp, 0x58
mov ebx, dword [rcx + 0x10]
mov rdi, rcx
test ebx, ebx
jle 0x1400fdd84
mov qword [rax + 8], rbp
mov ebp, dword [rdx + 8]
mov qword [rax + 0x10], rsi
mov esi, dword [rdx + 0xc]
mov qword [rax + 0x20], r14
mov r14d, dword [rdx + 4]
add esi, r14d
mov qword [rax - 0x18], r15
mov r15d, dword [rdx]
add ebp, r15d
sub ebx, 1
js 0x1400fdd6d
mov qword [rax + 0x18], r12
mov r12d, 4
nop dword [rax]
movsxd rcx, ebx
shl rcx, 4
add rcx, qword [rdi]
mov r9d, dword [rcx]
mov r8d, dword [rcx + 4]
mov r11d, dword [rcx + 8]
mov r10d, dword [rcx + 0xc]
lea edx, [r11 + r9]
lea eax, [r10 + r8]
cmp ebp, r9d
jle 0x1400fdd5c
cmp r15d, edx
jge 0x1400fdd5c
cmp esi, r8d
jle 0x1400fdd5c
cmp r14d, eax
jge 0x1400fdd5c
cmp r15d, r9d
jle 0x1400fdc6f
cmp r14d, r8d
jg 0x1400fdc35
cmp esi, eax
jl 0x1400fdc35
cmp ebp, edx
jl 0x1400fdc35
mov eax, r15d
sub eax, r9d
mov dword [rcx + 8], eax
jmp 0x1400fdd5c
sub edx, r15d
mov dword [rcx], r15d
mov dword [rcx + 8], edx
mov eax, r15d
sub eax, r9d
mov dword [rsp + 0x24], r8d
lea edx, [rbx + 1]
mov dword [rsp + 0x28], eax
mov rcx, rdi
mov dword [rsp + 0x20], r9d
lea r8, [rsp + 0x20]
mov dword [rsp + 0x2c], r10d
call fcn.1400fdee0
add ebx, 2
jmp 0x1400fdd5c
cmp ebp, edx
jge 0x1400fdcb7
sub edx, ebp
mov dword [rcx], ebp
mov dword [rcx + 8], edx
cmp r14d, r8d
jg 0x1400fdc87
cmp esi, eax
jge 0x1400fdd5c
mov eax, ebp
mov dword [rsp + 0x34], r8d
sub eax, r9d
mov dword [rsp + 0x30], r9d
lea r8, [rsp + 0x30]
mov dword [rsp + 0x38], eax
lea edx, [rbx + 1]
mov dword [rsp + 0x3c], r10d
mov rcx, rdi
call fcn.1400fdee0
add ebx, 2
jmp 0x1400fdd5c
cmp r14d, r8d
jle 0x1400fdd00
mov edx, r14d
sub edx, r8d
cmp esi, eax
jl 0x1400fdcce
mov dword [rcx + 0xc], edx
jmp 0x1400fdd5c
sub eax, r14d
mov dword [rcx + 4], r14d
mov dword [rcx + 0xc], eax
mov rcx, rdi
mov dword [rsp + 0x44], r8d
lea r8, [rsp + 0x40]
mov dword [rsp + 0x4c], edx
lea edx, [rbx + 1]
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x48], r11d
call fcn.1400fdee0
add ebx, 2
jmp 0x1400fdd5c
cmp esi, eax
jge 0x1400fdd0e
sub eax, esi
mov dword [rcx + 4], esi
mov dword [rcx + 0xc], eax
jmp 0x1400fdd5c
mov edx, dword [rdi + 0x10]
cmp ebx, edx
jae 0x1400fdd5c
dec edx
mov eax, edx
mov dword [rdi + 0x10], edx
sub eax, ebx
test eax, eax
jle 0x1400fdd35
movsxd r8, eax
lea rdx, [rcx + 0x10]
shl r8, 4
call sub.VCRUNTIME140.dll_memmove
mov edx, dword [rdi + 0x10]
mov r8d, dword [rdi + 8]
lea ecx, [rdx + rdx]
xor eax, eax
test ecx, ecx
cmovg eax, ecx
cmp r8d, eax
jle 0x1400fdd5c
cmp edx, r12d
cmovl edx, r12d
cmp edx, r8d
jge 0x1400fdd5c
mov rcx, rdi
call fcn.1400e5ef0
sub ebx, 1
jns 0x1400fdbd0
mov r12, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov r15, qword [rsp + 0x50]
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x140107e40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 0x10
mov rbx, rcx
mov r11, qword [rdx + 0x10]
mov r10, rdx
jb 0x140107e5e
mov r10, qword [rdx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x140107e94
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r11
jb 0x140107e80
mov r8, rdx
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x20]
call fcn.14006d870
mov rax, qword [rax + 8]
test rax, rax
jne 0x140107eb2
mov rax, qword [rbx + 0x28]
cmp rax, qword [rbx + 0x28]
je 0x140107ec7
add rax, 0x30
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
lea rax, [0x14036fb98]
add rsp, 0x30
pop rdi
ret

Function at 0x140107f90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x14033d010]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x90], rdx
cmp qword [rdx + 0x10], 0
je 0x1401080f9
lea r8, [rcx + 0x100]
lea rcx, [rsp + 0xa8]
call fcn.14007aac0
nop
mov r8, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140107ff1
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x140108023
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140108010
mov r8, rbx
lea rdx, [rsp + 0x80]
lea rcx, [r14 + 0x20]
call fcn.14006d870
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x140108046
mov rax, qword [r14 + 0x28]
jmp 0x14010804d
mov rdi, qword [r14 + 0x28]
mov rax, rdi
cmp rdi, rax
je 0x14010809a
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x78]
mov rcx, r14
call fcn.140107a60
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rax]
mov qword [rdi + 0x30], rcx
mov qword [rax], rdx
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1401080ec
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401080ec
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x1401080ec
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x78]
mov rcx, r14
call fcn.140107a60
nop
mov r9, rax
mov r8, rbx
lea rdx, [rsp + 0x98]
lea rcx, [r14 + 0x20]
call fcn.140108b30
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1401080ec
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401080ec
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
lea rcx, [rsp + 0xa8]
call fcn.14004f4d0
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14022d970
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop r14
pop rdi
pop rsi
ret
Function at 0x140108120
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x14033d010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x98], rdx
lea r8, [rcx + 0x100]
lea rcx, [rsp + 0xa0]
call fcn.14007aac0
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140108173
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1401081a3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140108190
mov r8, rdi
lea rdx, [rsp + 0x80]
lea rcx, [rbx + 0x60]
call fcn.14006d870
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1401081c6
mov rax, qword [rbx + 0x68]
jmp 0x1401081cd
mov rcx, qword [rbx + 0x68]
mov rax, rcx
cmp rcx, rax
je 0x140108237
lea rdi, [rcx + 0x30]
lea rax, [rsp + 0xa0]
cmp rdi, rax
je 0x14010820d
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0x10
cmovae rdx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xb0]
mov rcx, rdi
call fcn.14004f6a0
mov rbx, qword [rdi + 0x20]
mov r8, qword [rbx + 8]
lea rdx, [rdi + 0x20]
lea rcx, [rdi + 0x20]
call fcn.1400d4f80
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rdi + 0x28], 0
jmp 0x140108254
lea r9, [rsp + 0xa0]
mov r8, rdi
lea rdx, [rsp + 0x80]
lea rcx, [rbx + 0x60]
call fcn.140108e60
nop
lea rcx, [rsp + 0xa0]
call fcn.14004f4d0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14022d970
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
ret
Function at 0x14010dc50
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x14033d010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
mov rax, qword [rcx]
lea rdx, [rsp + 0xa0]
call qword [rax + 0x20]
nop
xor r8d, r8d
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x30]
call fcn.140204560
cmp dword [rax], 3
jne 0x14010ddc5
lea rcx, [rsp + 0xa0]
call fcn.14007b940
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140204560
cmp dword [rax], 1
jbe 0x14010dcd6
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call fcn.1400af0c0
jmp 0x14010de24
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], dil
lea r8d, [rdi + 0x3c]
lea rdx, str.Error_while_restoring_project_file._The_project_is_corupted.
lea rcx, [rsp + 0x60]
call fcn.14004f6a0
nop
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], dil
lea r8d, [rdi + 8]
lea rdx, str.internal
lea rcx, [rsp + 0x40]
call fcn.14004f6a0
nop
call fcn.140061350
mov r10, rax
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x80], rcx
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14010dd70
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x80], xmm0
lea r9, [rsp + 0x30]
mov r8d, 3
lea rdx, [rsp + 0x80]
mov rcx, r10
call fcn.1400d3640
nop
lea rcx, [rsp + 0x40]
call fcn.14004f4d0
nop
lea rcx, [rsp + 0x60]
call fcn.14004f4d0
jmp 0x14010de24
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14010ddec
mov rcx, qword [rbx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14010de03
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14010de05
xor edi, edi
lea rax, str.boost::filesystem::copy_file
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0xa0]
mov rdx, rbx
mov ecx, edi
call fcn.140202cc0
nop
lea rcx, [rsp + 0xa0]
call fcn.14004f460
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14022d970
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
ret
Function at 0x140110100
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x14033d010]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rdx
lea r9, [rsp + 0x48]
xor esi, esi
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x48], rsi
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x14011025e
test eax, eax
jne 0x14011025e
lea rax, [rsp + 0x40]
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x38], rax
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 0x104
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov dword [rsp + 0x40], esi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [rsp + 0x40], 1
je 0x140110246
test eax, eax
je 0x140110246
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], sil
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], sil
jne 0x1401101c0
mov r8, rbx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14004f6a0
lea rax, [rsp + 0x50]
cmp rdi, rax
je 0x140110211
mov rcx, rdi
call fcn.14004f4d0
movups xmm1, xmmword [rsp + 0x60]
mov qword [rsp + 0x60], rsi
movups xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], sil
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
lea rcx, [rsp + 0x50]
call fcn.14004f4d0
mov al, 1
mov rbx, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14022d970
mov rsi, qword [rsp + 0x1b8]
add rsp, 0x190
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetLastError_after_WideCharToMultiByte_returned__lu_n
call fcn.14010b760
xor al, al
jmp 0x14011021d
xor al, al
jmp 0x140110225

Function at 0x14011a960
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
xor eax, eax
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14011a9d2
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14011a9ce
lea rcx, [rsp + 0x58]
call fcn.1401310b0
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rax]
mov qword [rbx + 0x20], rdx
mov qword [rax], rcx
lea rax, [0x140273478]
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff0
cmp rcx, rax
je 0x14011a9ce
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14011a9ce
call fcn.14022dcf0
mov eax, dword [rsp + 0x40]
add qword [rbx + 0x18], rax
add rsp, 0x30
pop rbx
ret
Function at 0x140125360
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
add rcx, 0x20
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
xchg byte [rbx + 0x68], al
mov rax, qword [rbx + 0x10]
test rax, rax
jne 0x1401253cd
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140131640]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
xchg qword [rbx + 0x10], rax
mov eax, dword [rsp + 0x40]
xchg qword [rbx + 0x18], rax
mov edx, dword [rbx + 0x60]
mov rcx, qword [rbx + 0x10]
call fcn.140131730
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [rbx + 0x20]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1401253f0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
lea rbp, [rcx + 0x20]
mov qword [rsp + 0x58], rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140125570
mov eax, 1
xchg byte [rbx + 0x68], al
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test edi, edi
je 0x1401254d4
call qword [sym.imp.WINMM.dll_timeGetTime]
mov edx, eax
mov ecx, dword [0x14036fb70]
cmp eax, ecx
jae 0x140125461
add ecx, 0xfffffc18
cmp eax, ecx
jae 0x140125467
mov ecx, eax
xchg dword [0x14036fb70], ecx
jmp 0x140125467
xchg dword [0x14036fb70], eax
lea esi, [rdx + rdi]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1401254d4
test edi, edi
js 0x1401254a7
call qword [sym.imp.WINMM.dll_timeGetTime]
mov edx, eax
mov ecx, dword [0x14036fb70]
cmp eax, ecx
jae 0x14012549d
add ecx, 0xfffffc18
cmp eax, ecx
jae 0x1401254a3
mov ecx, eax
xchg dword [0x14036fb70], ecx
jmp 0x1401254a3
xchg dword [0x14036fb70], eax
cmp edx, esi
ja 0x1401254d4
mov rcx, qword [0x14036fb78]
test rcx, rcx
jne 0x1401254c0
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401254cb
mov edx, 2
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rbx + 0x10]
test rax, rax
jne 0x140125473
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140125570
lea rax, str.___killing_thread_by_force___
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.140133c60
nop
mov rcx, qword [0x14036ed40]
test rcx, rcx
je 0x140125516
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 8]
jmp 0x140125521
lea rcx, [rsp + 0x40]
call fcn.140131340
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff0
lea rax, [0x140273478]
cmp rcx, rax
je 0x14012554b
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14012554b
call fcn.14022dcf0
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140125560
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ecx, ecx
mov eax, ecx
xchg qword [rbx + 0x10], rax
xchg qword [rbx + 0x18], rcx
xor bl, bl
jmp 0x140125572
mov bl, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bl
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14012bcf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r14
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rsi, rcx
mov r9d, dword [rcx + 0x9c]
xor r12d, r12d
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
nop dword [rax]
mov edx, dword [rsi + 0x94]
mov ebp, dword [rsi + 0x58]
mov ecx, dword [rsi + 0x44]
sub ebp, edx
add ecx, 0xfffffefa
sub ebp, r9d
add ecx, ebx
cmp edx, ecx
jb 0x14012bdc0
mov rcx, qword [rsi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsi + 0x74]
mov rax, qword [rsi + 0x68]
sub dword [rsi + 0x98], ebx
sub dword [rsi + 0x94], ebx
sub dword [rsi + 0x84], ebx
lea rdx, [rax + r8*2]
nop
movzx ecx, word [rdx - 2]
lea rdx, [rdx - 2]
movzx eax, cx
sub ax, bx
cmp ecx, ebx
cmovb ax, r12w
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x14012bd70
mov rax, qword [rsi + 0x60]
mov r8d, ebx
lea rdx, [rax + rbx*2]
nop dword [rax]
movzx ecx, word [rdx - 2]
lea rdx, [rdx - 2]
movzx eax, cx
sub ax, bx
cmp ecx, ebx
cmovb ax, r12w
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x14012bda0
add ebp, ebx
mov r14, qword [rsi]
mov ecx, dword [r14 + 8]
test ecx, ecx
je 0x14012bea7
mov edx, dword [rsi + 0x9c]
mov r15d, dword [rsi + 0x94]
add r15, rdx
add r15, qword [rsi + 0x50]
cmp ecx, ebp
cmovbe ebp, ecx
test ebp, ebp
jne 0x14012bdf1
mov ebp, r12d
jmp 0x14012be53
mov rax, qword [r14 + 0x28]
sub ecx, ebp
mov dword [r14 + 8], ecx
mov ecx, dword [rax + 0x2c]
cmp ecx, 1
jne 0x14012be14
mov rdx, qword [r14]
mov r8d, ebp
mov ecx, dword [r14 + 0x4c]
call fcn.14012a3b0
jmp 0x14012be32
cmp ecx, 2
jne 0x14012be36
mov rdx, qword [r14]
test rdx, rdx
jne 0x14012be26
mov eax, r12d
jmp 0x14012be32
mov ecx, dword [r14 + 0x4c]
mov r8d, ebp
call fcn.14012a690
mov dword [r14 + 0x4c], eax
mov rdx, qword [r14]
mov rcx, r15
mov r8d, ebp
mov edi, ebp
call sub.VCRUNTIME140.dll_memcpy
add qword [r14], rdi
add dword [r14 + 0xc], ebp
mov edx, dword [rsi + 0x9c]
lea r9d, [rdx + rbp]
mov dword [rsi + 0x9c], r9d
cmp r9d, 3
jb 0x14012be91
mov eax, dword [rsi + 0x94]
mov rdx, qword [rsi + 0x50]
mov ecx, dword [rsi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rsi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rsi + 0x7c]
mov dword [rsi + 0x70], r8d
cmp r9d, 0x106
jae 0x14012bea7
mov rax, qword [rsi]
cmp dword [rax + 8], r12d
jne 0x14012bd20
mov r15, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rsi
ret
Function at 0x140131290
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x14033d010]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x30]
mov ecx, 0x204
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.140133d60
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140119b50
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff0
lea rax, [0x140273478]
cmp rcx, rax
je 0x14013131c
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x14013131c
call fcn.14022dcf0
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14022d970
add rsp, 0x450
pop rbx
ret

Function at 0x140131340
Capabilities:
Print debug messages

Disassembly:
push rbx
push rdi
sub rsp, 0x38
mov rax, qword [rcx]
mov qword [rsp + 0x50], rax
add rax, 0xfffffffffffffff0
lea rdi, [0x140273478]
cmp rax, rdi
je 0x140131362
lock inc dword [rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rax, [0x14029c9c9]
mov qword [rsp + 0x60], rax
lea rax, [0x14029c9c8]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.140121830
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rcx, [rax - 0x10]
cmp rcx, rdi
je 0x1401313b3
lock inc dword [rcx]
mov rax, qword [rsp + 0x50]
lea rcx, [rax - 0x10]
mov ebx, 0xffffffff
cmp rcx, rdi
je 0x1401313d3
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x1401313d3
call fcn.14022dcf0
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x20]
call fcn.1401327d0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff0
cmp rcx, rdi
je 0x14013140a
lock xadd dword [rcx], ebx
dec ebx
cmp ebx, 0xffffffff
jne 0x14013140a
call fcn.14022dcf0
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x1401325e0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x60
lea rdx, [rbp + 0x40]
call fcn.140131d50
nop
mov rbx, qword [rbp + 0x40]
mov qword [rbp + 0x48], rbx
xor edi, edi
lea esi, [rdi - 1]
cmp byte [rbx], dil
je 0x140132629
nop word [rax + rax]
lea rcx, [rbp + 0x48]
call fcn.140117990
cmp eax, 0x40
je 0x14013262b
inc edi
mov rax, qword [rbp + 0x48]
cmp byte [rax], 0
jne 0x140132610
mov edi, esi
shr edi, 0x1f
lea r15, [0x140273478]
xor dil, 1
je 0x1401326ef
mov qword [rbp - 0x30], rbx
xor edi, edi
cmp byte [rbx], dil
je 0x140132669
nop word [rax + rax]
lea rcx, [rbp - 0x30]
call fcn.140117990
cmp eax, 0x3a
je 0x14013266b
inc edi
mov rax, qword [rbp - 0x30]
cmp byte [rax], 0
jne 0x140132650
mov edi, esi
shr edi, 0x1f
xor dil, 1
jne 0x1401326ef
lea rax, str.mailto:
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x38]
call fcn.140133c60
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x38]
call fcn.1401218b0
mov rdi, qword [rax]
lea rax, [rdi - 0x10]
cmp rax, r15
je 0x1401326ad
lock inc dword [rax]
mov rbx, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x38]
add rcx, 0xfffffffffffffff0
cmp rcx, r15
je 0x1401326d0
mov eax, esi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1401326cc
call fcn.14022dcf0
mov rbx, qword [rbp + 0x40]
mov qword [rbp + 0x40], rdi
lea rcx, [rbx - 0x10]
cmp rcx, r15
je 0x1401326ef
mov eax, esi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1401326ef
call fcn.14022dcf0
lea rax, [r15 + 0x10]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x18]
call fcn.1401327d0
mov rbx, qword [rax]
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.1401327d0
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
mov r9, rbx
mov r8, qword [rax]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
seta bl
mov rcx, qword [rbp - 0x28]
add rcx, 0xfffffffffffffff0
cmp rcx, r15
je 0x14013275c
mov eax, esi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14013275c
call fcn.14022dcf0
nop
mov rcx, qword [rbp + 0x40]
add rcx, 0xfffffffffffffff0
cmp rcx, r15
je 0x140132779
lock xadd dword [rcx], esi
dec esi
cmp esi, 0xffffffff
jne 0x140132779
call fcn.14022dcf0
movzx eax, bl
add rsp, 0x60
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret