joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402e0230
Capabilities:
Create thread
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.1402d6048
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x1402e0283
test rbx, rbx
je 0x1402e0274
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x1402e0283
mov edi, 4
jmp 0x1402e032c
call fcn.1402d5df0
test al, al
jne 0x1402e02a0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x1402e032c
test bpl, bpl
je 0x1402e0303
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x1402e0054]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1402e032c
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x1402e02fd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1402e032c
mov edi, dword [rsp + 0x44]
jmp 0x1402e02f5
call fcn.1402d5f74
test al, al
jne 0x1402e0314
bts esi, 0x15
xor ecx, ecx
jmp 0x1402e031c
call fcn.1402d5eac
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.1402d5c28
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x1402f1c7c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1402f1c8f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1402f2d78
lea rdx, [0x140464038]
lea rcx, [rsp + 0x20]
call fcn.14028b618
int3

Function at 0x140300ab4
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140482058]
xor edx, edx
jmp fcn.1402f1c7c

Function at 0x1403025c4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140482058]
jmp fcn.1402f1c7c

Function at 0x14031f694
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov bl, r8b
mov r11b, dl
xor r10b, r10b
mov edi, 8
mov al, r11b
mov dl, r11b
add al, al
mov r9b, bl
movzx r8d, al
mov al, r10b
xor al, r11b
shr bl, 1
and r9b, 1
movzx ecx, al
movzx eax, r10b
cmove ecx, eax
mov r10b, cl
mov cl, r8b
xor cl, 0x1b
test dl, dl
movzx r11d, cl
cmovns r11d, r8d
sub rdi, 1
jne 0x14031f6ac
mov rbx, qword [rsp + 8]
mov al, r10b
mov rdi, qword [rsp + 0x10]
ret

Function at 0x14031f700
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov eax, dword [rcx]
mov r8, rdx
mov rbx, rcx
mov r9d, 4
xor r11d, r11d
xor r10d, r10d
test eax, eax
jle 0x14031f74c
mov rdx, qword [r8]
inc r11d
movzx eax, byte [rdx + r10]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
lea rax, [0x1403d97b0]
mov al, byte [rcx + rax]
mov byte [rdx + r10], al
inc r10
mov eax, dword [rbx]
cmp r11d, eax
jl 0x14031f71d
add r8, 8
sub r9, 1
jne 0x14031f713
mov rbx, qword [rsp + 8]
ret
Function at 0x14031f764
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov r12d, 4
mov ecx, r12d
mov rbp, r8
mov rsi, rdx
call fcn.14000d15c
mov ecx, r12d
mov rbx, rax
call fcn.14000d15c
mov r9d, dword [rdi + 4]
xor edx, edx
shl r9d, 2
mov r15, rax
test r9d, r9d
jle 0x14031f7cf
mov rcx, rbp
sub rsi, rbp
mov al, byte [rsi + rcx]
inc edx
mov byte [rcx], al
inc rcx
mov eax, dword [rdi + 4]
shl eax, 2
cmp edx, eax
jl 0x14031f7bb
mov eax, dword [rdi + 8]
mov esi, dword [rdi + 4]
inc eax
imul eax, dword [rdi]
shl esi, 2
shl eax, 2
cmp esi, eax
jge 0x14031f8fc
movsxd rax, esi
lea r14, [rbp - 3]
add r14, rax
mov cl, byte [r14 - 1]
mov eax, esi
cdq
mov byte [rbx], cl
mov r8b, byte [r14]
and edx, 3
add eax, edx
mov byte [rbx + 1], r8b
mov r9b, byte [r14 + 1]
sar eax, 2
mov byte [rbx + 2], r9b
cdq
mov r10b, byte [r14 + 2]
mov byte [rbx + 3], r10b
idiv dword [rdi + 4]
test edx, edx
jne 0x14031f86e
mov rdx, rbx
mov byte [rbx], r8b
mov byte [rbx + 1], r9b
mov byte [rbx + 2], r10b
mov byte [rbx + 3], cl
call fcn.14031f9b4
mov r9d, dword [rdi + 4]
mov eax, esi
cdq
shl r9d, 2
idiv r9d
mov rdx, r15
mov r8d, eax
call fcn.14031f930
mov r8, r15
mov rdx, rbx
sub r8, rbx
mov rcx, r12
mov al, byte [r8 + rdx]
xor byte [rdx], al
inc rdx
sub rcx, 1
jne 0x14031f85d
jmp 0x14031f881
cmp dword [rdi + 4], 6
jle 0x14031f881
cmp edx, r12d
jne 0x14031f881
mov rdx, rbx
call fcn.14031f9b4
mov ecx, dword [rdi + 4]
mov eax, esi
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
mov al, byte [rcx + rbp]
mov ecx, esi
xor al, byte [rbx]
mov byte [r14 + 3], al
mov eax, dword [rdi + 4]
shl eax, 2
sub ecx, eax
lea eax, [rcx + 1]
cdqe
mov cl, byte [rax + rbp]
xor cl, byte [rbx + 1]
mov byte [r14 + 4], cl
mov ecx, esi
mov eax, dword [rdi + 4]
shl eax, 2
sub ecx, eax
lea eax, [rcx + 2]
cdqe
mov cl, byte [rax + rbp]
xor cl, byte [rbx + 2]
mov byte [r14 + 5], cl
mov ecx, esi
mov eax, dword [rdi + 4]
add esi, r12d
shl eax, 2
sub ecx, eax
add ecx, 3
movsxd rax, ecx
mov cl, byte [rax + rbp]
xor cl, byte [rbx + 3]
mov byte [r14 + 6], cl
add r14, r12
mov eax, dword [rdi + 8]
inc eax
imul eax, dword [rdi]
shl eax, 2
cmp esi, eax
jl 0x14031f7f2
mov rcx, r15
call fcn.14000d164
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
jmp fcn.14000d164

Function at 0x14031f930
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
dec r8d
xor r11d, r11d
mov r9b, 1
test r8d, r8d
jle 0x14031f959
mov r10d, r8d
mov al, r9b
add r9b, r9b
shr al, 7
movzx eax, al
imul ecx, eax, 0x1b
xor r9b, cl
sub r10, 1
jne 0x14031f941
mov byte [rdx], r9b
mov word [rdx + 2], r11w
mov byte [rdx + 1], r11b
ret

Function at 0x14031f9b4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r8d, 4
movzx eax, byte [rdx]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
lea rax, [0x1403d98b0]
mov al, byte [rcx + rax]
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x14031f9ba
ret
Function at 0x14031f9e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, dword [rcx]
mov rdi, rcx
mov r11d, 4
xor ebx, ebx
xor r9d, r9d
test eax, eax
jle 0x14031fa22
mov r10, r8
mov al, byte [r10]
inc ebx
mov rcx, qword [rdx]
lea r10, [r10 + 4]
xor byte [rcx + r9], al
inc r9
mov eax, dword [rdi]
cmp ebx, eax
jl 0x14031fa09
add rdx, 8
inc r8
sub r11, 1
jne 0x14031f9fd
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x14031fabc
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rdx
mov qword [rsp + 8], rcx
mov r10, rdx
lea r9, [rsp + 8]
lea rdx, [rsp + 0x10]
mov r11d, 4
sub rdx, r8
sub r9, r8
mov cl, byte [r8]
mov al, cl
mov byte [rdx + r8], cl
sar al, 7
add cl, cl
and al, 0x1b
xor al, cl
mov byte [r9 + r8], al
inc r8
sub r11, 1
jne 0x14031fadd
mov r8b, byte [rsp + 0x11]
mov r9b, byte [rsp + 0x12]
mov al, r8b
mov dl, byte [rsp + 0x13]
xor al, r9b
mov cl, byte [rsp + 0xb]
xor al, dl
xor al, byte [rsp + 8]
xor al, byte [rsp + 9]
xor cl, byte [rsp + 0x10]
mov byte [r10], al
mov al, byte [rsp + 0x10]
xor al, byte [rsp + 0xa]
xor al, r9b
xor al, dl
xor al, byte [rsp + 9]
mov byte [r10 + 1], al
mov al, cl
xor al, byte [rsp + 0xa]
xor cl, r8b
xor al, r8b
xor cl, r9b
xor cl, byte [rsp + 8]
xor al, dl
mov byte [r10 + 2], al
mov byte [r10 + 3], cl
ret

Function at 0x14031fc64
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov eax, dword [rcx]
mov r8, rdx
mov rbx, rcx
mov r9d, 4
xor r11d, r11d
xor r10d, r10d
test eax, eax
jle 0x14031fcb0
mov rdx, qword [r8]
inc r11d
movzx eax, byte [rdx + r10]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
lea rax, [0x1403d98b0]
mov al, byte [rcx + rax]
mov byte [rdx + r10], al
inc r10
mov eax, dword [rbx]
cmp r11d, eax
jl 0x14031fc81
add r8, 8
sub r9, 1
jne 0x14031fc77
mov rbx, qword [rsp + 8]
ret
Function at 0x140320348
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
mov esi, r8d
mov ecx, r8d
mov rbx, r9
mov r13d, r8d
call fcn.14000d15c
mov ecx, dword [rbp + 0xc]
mov rdi, rax
call fcn.14000d15c
mov r10d, dword [rbp + 8]
mov r12, rax
inc r10d
imul r10d, dword [rbp]
shl r10d, 2
movsxd rcx, r10d
call fcn.14000d15c
mov r8, rax
mov qword [rsp + 0x60], rax
mov rdx, rbx
mov rcx, rbp
mov r15, rax
call fcn.14031f764
mov r8d, dword [rbp + 0xc]
mov rcx, r12
mov rdx, qword [rsp + 0x80]
call fcn.14028a590
xor r14d, r14d
test esi, esi
je 0x14032042f
mov r13, qword [rsp + 0x68]
lea rbx, [r14 + rdi]
mov r9, qword [rsp + 0x60]
mov r8, rbx
mov r15d, r14d
mov rcx, rbp
add r13, r15
mov rdx, r13
call fcn.14031fcc8
cmp dword [rbp + 0xc], 0
jbe 0x14032040f
mov r8d, dword [rbp + 0xc]
mov rcx, r12
sub rcx, r15
sub rcx, rdi
mov al, byte [rcx + rbx]
xor byte [rbx], al
inc rbx
sub r8, 1
jne 0x140320401
mov r8d, dword [rbp + 0xc]
mov rdx, r13
mov rcx, r12
call fcn.14028a590
add r14d, dword [rbp + 0xc]
cmp r14d, esi
jb 0x1403203cc
mov r15, qword [rsp + 0x60]
mov r13, rsi
mov r8, qword [rsp + 0x88]
lea eax, [rsi - 1]
movzx ecx, byte [rax + rdi]
mov r11d, eax
mov dword [r8], ecx
test ecx, ecx
je 0x14032047d
cmp ecx, dword [rbp + 0xc]
ja 0x14032047d
mov edx, 2
cmp rcx, rdx
jb 0x140320471
lea r9, [rdi - 2]
add r9, r13
movzx eax, byte [r9]
cmp ecx, eax
jne 0x14032047d
inc rdx
dec r9
cmp rdx, rcx
jbe 0x14032045e
movzx eax, byte [r11 + rdi]
sub esi, eax
mov dword [r8], esi
jmp 0x14032048b
and dword [r8], 0
mov rcx, rdi
call fcn.14000d164
xor edi, edi
mov rcx, r12
call fcn.14000d164
mov rcx, r15
call fcn.14000d164
mov rbx, qword [rsp + 0x70]
mov rax, rdi
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1403204bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13, qword [rsp + 0x78]
mov r10, rdx
xor edx, edx
mov eax, r8d
div dword [rcx + 0xc]
mov rbx, r9
mov rdx, r10
inc eax
mov rbp, rcx
imul eax, dword [rcx + 0xc]
mov r9d, eax
mov dword [r13], eax
call fcn.14031fff4
mov ecx, dword [r13]
mov r15, rax
call fcn.14000d15c
mov ecx, dword [rbp + 0xc]
mov r12, rax
call fcn.14000d15c
mov ecx, dword [rbp + 8]
mov rdi, rax
inc ecx
imul ecx, dword [rbp]
shl ecx, 2
movsxd rcx, ecx
call fcn.14000d15c
mov r8, rax
mov rdx, rbx
mov rcx, rbp
mov r14, rax
call fcn.14031f764
mov r8d, dword [rbp + 0xc]
mov rcx, rdi
mov rdx, qword [rsp + 0x70]
call fcn.14028a590
xor esi, esi
cmp dword [r13], esi
jbe 0x1403205ad
cmp dword [rbp + 0xc], 0
jbe 0x14032057f
mov edx, dword [rbp + 0xc]
mov rcx, rdi
mov r8d, esi
sub r8, rdi
add r8, r15
mov al, byte [r8 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140320570
mov ebx, esi
mov r9, r14
add rbx, r12
mov rdx, rdi
mov r8, rbx
mov rcx, rbp
call fcn.14031fe40
mov r8d, dword [rbp + 0xc]
mov rdx, rbx
mov rcx, rdi
call fcn.14028a590
add esi, dword [rbp + 0xc]
cmp esi, dword [r13]
jb 0x14032055b
mov rcx, rdi
call fcn.14000d164
mov rcx, r15
call fcn.14000d164
mov rcx, r14
call fcn.14000d164
mov rbx, qword [rsp + 0x50]
mov rax, r12
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140320dc4
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0xf8
lea r8, [rsp]
mov rdx, rcx
sub rdx, r8
lea rax, [rsp]
mov r8d, reloc.OLEAUT32.dll_SafeArrayDestroy
movdqa xmm0, xmmword [rdx + rax]
movdqa xmmword [rax], xmm0
lea rax, [rax + 0x10]
sub r8, 1
jne 0x140320ddf
movdqa xmm0, xmmword [rsp]
lea rax, [rsp + 0x10]
movdqa xmmword [rcx + 0xe0], xmm0
lea rdx, [rcx + 0xd0]
mov r8d, SafeArrayGetDim
aesimc xmm0, xmmword [rax]
movdqa xmmword [rdx], xmm0
lea rdx, [rdx - 0x10]
lea rax, [rax + 0x10]
sub r8, 1
jne 0x140320e11
movdqa xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rcx], xmm0
add rsp, 0xf8
ret

Function at 0x140321628
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov r15, r8
mov r14, rdx
mov rbx, rcx
xor edi, edi
mov dword [rax - 0x38], edi
lea r9, [r8 + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r9
shr rdx, 1
shl rdx, 2
mov r12, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov qword [rcx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rcx + 0x10], rdi
cmp qword [rcx + 0x18], 0x10
jb 0x140321690
mov rax, qword [rcx]
jmp 0x140321693
mov rax, rbx
mov byte [rax], dil
mov esi, 1
mov dword [rsp + 0x20], esi
mov rbp, qword [rcx + 0x10]
cmp rbp, rdx
ja 0x1403216d1
cmp qword [rcx + 0x18], rdx
je 0x1403216d1
mov r8b, sil
call fcn.1400035a4
test al, al
je 0x1403216d1
mov qword [rbx + 0x10], rbp
cmp qword [rbx + 0x18], 0x10
jb 0x1403216ca
mov rax, qword [rbx]
jmp 0x1403216cd
mov rax, rbx
mov byte [rax + rbp], dil
test r15, r15
je 0x140321796
movzx eax, byte [rdi + r14]
shr rax, 2
mov dl, byte [rax + r12]
mov rcx, rbx
call fcn.140003330
mov ebp, esi
cmp rbp, r15
jae 0x14032175c
movzx ecx, byte [rdi + r14]
and ecx, 3
shl ecx, 4
movzx eax, byte [r14 + rbp]
shr eax, 4
add ecx, eax
mov dl, byte [rcx + r12]
mov rcx, rbx
call fcn.140003330
lea eax, [rsi + 1]
mov edi, eax
cmp rdi, r15
jae 0x14032174e
movzx ecx, byte [r14 + rbp]
and ecx, 0xf
movzx eax, byte [rax + r14]
shr eax, 6
lea eax, [rax + rcx*4]
mov dl, byte [rax + r12]
mov rcx, rbx
call fcn.140003330
movzx eax, byte [rdi + r14]
and eax, 0x3f
mov dl, byte [rax + r12]
jmp 0x14032177f
movzx eax, byte [r14 + rbp]
and eax, 0xf
mov dl, byte [r12 + rax*4]
jmp 0x140321775
movzx eax, byte [rdi + r14]
and eax, 3
add rax, rax
mov dl, byte [r12 + rax*8]
mov rcx, rbx
call fcn.140003330
mov dl, 0x3d
mov rcx, rbx
call fcn.140003330
mov dl, 0x3d
mov rcx, rbx
call fcn.140003330
add esi, 3
lea edi, [rsi - 1]
cmp rdi, r15
jb 0x1403216da
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140322a10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r9d, r9d
mov rdi, r8
mov eax, r9d
mov rsi, rdx
mov r11, rcx
mov r10, rcx
mov byte [r10], al
inc eax
inc r10
cmp eax, 0x100
jl 0x140322a31
mov r8d, r9d
mov r10, r11
movzx ebx, byte [r10]
xor edx, edx
mov eax, r8d
div edi
movzx eax, byte [rdx + rsi]
add r9d, eax
add r9d, ebx
and r9d, 0x800000ff
jge 0x140322a71
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rcx, r9d
inc r8d
mov al, byte [rcx + r11]
mov byte [r10], al
inc r10
mov byte [rcx + r11], bl
cmp r8d, 0x100
jl 0x140322a46
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x140322aa4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r9d, r9d
mov rdi, rdx
mov r11, rcx
mov r10d, r9d
test r8d, r8d
je 0x140322b2a
mov esi, r8d
inc r9d
and r9d, 0x800000ff
jge 0x140322ae0
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd r8, r9d
movzx ebx, byte [r8 + r11]
add r10d, ebx
and r10d, 0x800000ff
jge 0x140322b01
dec r10d
or r10d, 0xffffff00
inc r10d
movsxd rdx, r10d
mov cl, byte [rdx + r11]
mov byte [r8 + r11], cl
mov byte [rdx + r11], bl
movzx edx, byte [r8 + r11]
add rdx, rbx
movzx ecx, dl
mov dl, byte [rcx + r11]
xor byte [rdi], dl
inc rdi
sub rsi, 1
jne 0x140322ac7
mov rbx, qword [rsp + 8]
mov al, 1
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x140323994
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rax, r8
xor ecx, ecx
mov rdi, rdx
mov dword [rsp + 0x20], ecx
mov r8, r9
mov rdx, rax
mov qword [rbx], rcx
mov qword [rbx + 8], rcx
mov rcx, rbx
mov dword [rbx + 0x50], 0x6a09e667
mov dword [rbx + 0x54], 0xbb67ae85
mov dword [rbx + 0x58], 0x3c6ef372
mov dword [rbx + 0x5c], 0xa54ff53a
mov dword [rbx + 0x60], 0x510e527f
mov dword [rbx + 0x64], 0x9b05688c
mov dword [rbx + 0x68], 0x1f83d9ab
mov dword [rbx + 0x6c], 0x5be0cd19
call fcn.140323d28
mov rdx, rdi
mov rcx, rbx
call fcn.140323a94
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x140325b74
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.14028ace0
mov r8, rbx
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.1402ad838
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x38]
call fcn.14028ace0
and dword [rsp + 0x44], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov eax, reloc.OLEAUT32.dll_SafeArrayLock
mov dword [rsp + 0x28], 3
xorps xmm0, xmm0
mov word [rsp + 0x40], ax
movdqu xmmword [rsp + 0x48], xmm0
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x140325bf8
mov al, 1
jmp 0x140325c17
cmp byte [rdi + 0x20], 0
mov rcx, rbx
je 0x140325c0f
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x140325c15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor al, al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret

Function at 0x140325c30
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x260
mov rbp, rdx
mov dword [rsp + 0x20], 0x238
xor edx, edx
xor dil, dil
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140325cea
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov r14d, 1
jmp 0x140325cdc
lea rdx, [rsp + 0x4c]
mov rcx, rbp
call fcn.1402ad654
test eax, eax
jne 0x140325cce
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140325cc5
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, r14d
movzx edi, dil
cmove edi, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, r14d
je 0x140325c84
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov al, dil
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x140325d14
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor ebx, ebx
mov rsi, rax
test rax, rax
je 0x140325d79
mov r8d, 0x10000
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x140325d6e
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov bl, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140325da0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call fcn.14000dfe0
mov rcx, rax
test rax, rax
jne 0x140325dca
mov ecx, 0x80004005
call fcn.1400069ec
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [0x1403da5e0]
lea rcx, [rsp + 0x50]
call fcn.140006f04
nop
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x48]
call fcn.140009708
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140325e1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140325e4b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x30
pop rbx
ret
Function at 0x14032623c
Capabilities:
Delete registry key
Get common file path
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x778]
sub rsp, 0x860
xor r14d, r14d
mov rsi, rcx
mov r15d, 0x208
cmp byte [rcx + 0x20], r14b
je 0x1403262e4
mov r8d, r15d
lea rcx, [rbp + 0x550]
xor edx, edx
call fcn.14028ace0
mov ebx, 0x104
lea rdx, [rbp + 0x550]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea r8d, [r14 + 4]
lea rcx, [rbp + 0x550]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov r8d, r15d
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.14028ace0
mov r8d, ebx
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140325b74
jmp 0x140326358
lea rdi, [rcx + 8]
mov edx, 0x1000
mov rax, qword [rdi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or ecx, eax
jge 0x140326309
mov rcx, rdi
call fcn.1400077c4
mov rbx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rdx, rbx
mov rcx, rsi
call fcn.140325b74
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14032632d
mov eax, r14d
jmp 0x14032633e
movsxd rdx, dword [rcx - 0xc]
call fcn.1402ad464
test eax, eax
js 0x140326423
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x140326423
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], r14w
mov r8, r15
lea rcx, [rbp + 0x130]
xor edx, edx
call fcn.14028ace0
xor r9d, r9d
lea rdx, [rbp + 0x130]
xor ecx, ecx
lea r8d, [r9 + 0x23]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rdx, qword [rsi]
lea rcx, [rbp + 0x130]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x130]
mov rcx, rsi
call fcn.140325b74
mov r8, r15
lea rcx, [rbp + 0x340]
xor edx, edx
call fcn.14028ace0
xor r9d, r9d
lea rdx, [rbp + 0x340]
xor ecx, ecx
lea r8d, [r9 + 2]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rdx, qword [rsi]
lea rcx, [rbp + 0x340]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x340]
mov rcx, rsi
call fcn.140325b74
mov rdx, qword [rsi + 0x10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rdx, qword [rsi + 0x10]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400069ec
int3