joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400036c4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x140
mov r12, rcx
mov ebx, r8d
mov rdi, rdx
mov ebp, 0x120
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8, rbp
call sub.msvcrt.dll_memset
lea rsi, [r12 + 0x10]
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov rdx, rdi
mov qword [r12 + 8], rsi
call fcn.1400033d8
test eax, eax
mov r11d, eax
jne 0x140003813
mov ecx, dword [rsp + 0x20]
lea edi, [rax + 4]
mov dword [r12], ecx
shl ecx, 2
movsxd rdx, ecx
mov rcx, qword [rsp + 0x28]
lea r9, [rcx + rdx*4]
mov ecx, dword [r9]
add r9, rdi
mov dword [rsi], ecx
mov eax, dword [r9]
add rsi, rdi
mov dword [rsi], eax
add r9, rdi
add rsi, rdi
mov eax, dword [r9]
add r9, rdi
mov dword [rsi], eax
mov eax, dword [r9]
add rsi, rdi
mov dword [rsi], eax
mov r10d, dword [r12]
add rsi, rdi
sub r10d, 1
sub r9, 0x1c
test r10d, r10d
jle 0x1400037f3
lea r12, [0x140000000]
mov rbx, rdi
movzx eax, byte [r9]
movzx edx, byte [rax + r12 + 0x8bbd0]
movzx eax, byte [r9 + 3]
movzx ecx, byte [rax + r12 + 0x8bbd0]
movzx eax, byte [r9 + 2]
mov r8d, dword [r12 + rdx*4 + 0x8c900]
xor r8d, dword [r12 + rcx*4 + 0x8bcd0]
movzx ecx, byte [rax + r12 + 0x8bbd0]
movzx eax, byte [r9 + 1]
xor r8d, dword [r12 + rcx*4 + 0x8c0d0]
movzx ecx, byte [rax + r12 + 0x8bbd0]
add r9, rdi
xor r8d, dword [r12 + rcx*4 + 0x8c500]
mov dword [rsi], r8d
add rsi, rdi
sub rbx, 1
jne 0x140003780
sub r10d, 1
sub r9, 0x20
test r10d, r10d
jg 0x14000377d
mov eax, dword [r9]
mov dword [rsi], eax
add rsi, rdi
add r9, rdi
mov eax, dword [r9]
mov dword [rsi], eax
mov eax, dword [r9 + rdi]
mov dword [rsi + rdi], eax
mov eax, dword [r9 + rdi + 4]
mov dword [rsi + rdi + 4], eax
lea rax, [rsp + 0x20]
mov byte [rax], 0
add rax, 1
sub rbp, 1
jne 0x140003818
mov eax, r11d
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x14000432c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
test r8b, 0xf
mov r14, r9
mov r13d, edx
mov r15, rcx
je 0x140004361
mov eax, 0xffffffde
jmp 0x140004469
test edx, edx
jne 0x1400043e4
test r8, r8
je 0x140004467
mov rbx, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
lea rsi, [r8 - 1]
mov rbp, r9
shr rsi, 4
lea edi, [rdx + 0x10]
sub rbp, rbx
add rsi, 1
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov r8, rbx
mov rdx, r12
mov rcx, r15
call fcn.140003d2c
mov rcx, rdi
mov al, byte [rbx + rbp]
xor byte [rbx], al
add rbx, 1
sub rcx, 1
jne 0x1400043b4
lea rdx, [rsp + 0x20]
mov r8, rdi
mov rcx, r14
call sub.msvcrt.dll_memcpy
add r12, rdi
sub rbp, rdi
sub rsi, 1
jne 0x140004393
jmp 0x140004467
test r8, r8
je 0x140004467
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
lea rsi, [r8 - 1]
mov r12, r9
shr rsi, 4
mov edi, InitCommonControls
sub r12, rbp
add rsi, 1
mov rdx, rbx
mov rcx, rbp
mov r8, rdi
sub rdx, rbp
mov al, byte [r12 + rcx]
xor al, byte [rcx]
mov byte [rdx + rcx], al
add rcx, 1
sub r8, 1
jne 0x14000441c
cmp r13d, 1
mov r8, rbx
mov rdx, rbx
mov rcx, r15
jne 0x140004445
call fcn.140003848
jmp 0x14000444a
call fcn.140003d2c
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call sub.msvcrt.dll_memcpy
add rbp, rdi
sub r12, rdi
add rbx, rdi
sub rsi, 1
jne 0x140004410
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140004488
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
and dword [rcx], 0
and dword [rcx + 4], 0
test edx, edx
jne 0x1400044cd
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
mov dword [rcx + 0x24], 0x5be0cd19
jmp 0x140004505
mov dword [rcx + 8], 0xc1059ed8
mov dword [rcx + 0xc], 0x367cd507
mov dword [rcx + 0x10], 0x3070dd17
mov dword [rcx + 0x14], 0xf70e5939
mov dword [rcx + 0x18], 0xffc00b31
mov dword [rcx + 0x1c], 0x68581511
mov dword [rcx + 0x20], 0x64f98fa7
mov dword [rcx + 0x24], 0xbefa4fa4
mov dword [rcx + 0xe8], edx
ret
Function at 0x140006eb4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov r12d, 0x40
mov rdi, rdx
mov rsi, rcx
lea edx, [r12 - 0xa]
mov r8, r12
add rcx, 0x68
call sub.msvcrt.dll_memset
lea rbx, [rsi + 0xa8]
lea edx, [r12 + 0x1c]
mov rcx, rbx
mov r8, r12
call sub.msvcrt.dll_memset
lea ecx, [r12 - 0x2c]
mov al, byte [rdi]
xor byte [rbx - 0x40], al
mov al, byte [rdi]
add rdi, 1
xor byte [rbx], al
add rbx, 1
sub rcx, 1
jne 0x140006f06
xor edx, edx
mov rcx, rsi
call fcn.140004488
lea rdx, [rsi + 0x68]
mov r8, r12
call fcn.140006c48
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x140007420
Capabilities:
Parse pe header
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [0x140000000], 0x5a4d
je 0x14000745c
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x140000000]
jmp 0x1400074ea
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x140007480
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x1400074ea
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x1400074c7
cmp ecx, 0x20b
je 0x14000749f
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x1400074ea
cmp dword [rax + 0x84], 0xe
ja 0x1400074b3
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x1400074ea
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x1400074ea
cmp dword [rax + 0x74], 0xe
ja 0x1400074d8
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x1400074ea
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x14008fa00], 0xffffffffffffffff
mov qword [0x14008fa08], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x14008af6c]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x14008af68]
mov dword [rcx], eax
call fcn.1400076f0
cmp dword [section..data], 0
jne 0x140007544
lea rcx, [fcn.1400076f0]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x140076970]
lea rcx, [0x140076968]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x14008af64]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x14008af60]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___wgetmainargs]
lea rdx, [0x140076960]
lea rcx, [0x140076908]
call sub.msvcrt.dll__initterm
mov r8, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [r8], 0
jne 0x1400075b9
mov eax, 0xff
jmp 0x140007689
mov r8, qword [r8]
mov qword [rsp + 0x30], r8
cmp word [r8], 0x22
jne 0x140007600
nop
nop
add r8, 2
mov qword [rsp + 0x30], r8
movzx eax, word [r8]
test ax, ax
je 0x1400075ea
cmp ax, 0x22
je 0x1400075ea
jmp 0x1400075d0
cmp word [r8], 0x22
jne 0x140007612
add r8, 2
mov qword [rsp + 0x30], r8
jmp 0x140007612
cmp word [r8], 0x20
jbe 0x140007612
add r8, 2
mov qword [rsp + 0x30], r8
jmp 0x140007600
movzx eax, word [r8]
test ax, ax
je 0x14000762c
cmp ax, 0x20
ja 0x14000762c
add r8, 2
mov qword [rsp + 0x30], r8
jmp 0x140007612
test byte [rsp + 0x8c], 1
je 0x140007641
movzx r9d, word [rsp + 0x90]
jmp 0x140007647
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.1400561b4
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x140007663
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x140007687
mov eax, edi
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x140007864
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 8], 0
mov rbx, rcx
jne 0x14000796f
lea rdi, [0x14008ad40]
mov edx, 0x65
mov rcx, rdi
call fcn.140066f78
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, 0x66
mov rcx, rdi
mov qword [rbx + 8], rax
call fcn.140066fe8
mov rcx, qword [rbx + 8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x67
mov rcx, rdi
mov qword [rbx + 0x20], rax
call fcn.140066fe8
mov rcx, qword [rbx + 8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x68
mov rcx, rdi
mov qword [rbx + 0x28], rax
call fcn.140066fe8
mov rcx, qword [rbx + 8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x69
mov rcx, rdi
mov qword [rbx + 0x30], rax
call fcn.140066fe8
mov rcx, qword [rbx + 8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x6a
mov rcx, rdi
mov qword [rbx + 0x38], rax
call fcn.140066fe8
mov rcx, qword [rbx + 8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x6b
mov rcx, rdi
mov qword [rbx + 0x40], rax
call fcn.140066fe8
mov rcx, qword [rbx + 8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x6c
mov rcx, rdi
mov qword [rbx + 0x10], rax
call fcn.140066fe8
mov rcx, qword [rbx + 8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x18], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400080d4
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rax, rdx
mov r12, rcx
xor edx, edx
mov rcx, rax
call fcn.140063024
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x14000817d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 2
mov ebp, eax
jbe 0x140008174
lea ecx, [rbp + 2]
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and dword [rsp + 0x60], 0
and qword [rsp + 0x20], 0
lea ebx, [rbp - 2]
lea r9, [rsp + 0x60]
mov rdx, rdi
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [rbp - 1]
mov rdx, rdi
mov rcx, r12
mov byte [rbx + rdi], 0
mov byte [rbp + rdi], 0
mov byte [rax + rdi], 0
call fcn.140007f04
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140008c44
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x660
and word [rsp + 0x30], 0
mov rbx, rcx
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov edi, 0x1c
lea rcx, [rsp + 0x30]
mov edx, edi
mov dword [rbx + 8], 1
call fcn.14004ec0c
lea edx, [rdi + 0x6d]
lea rcx, [0x14008ad40]
call fcn.140066f78
lea rcx, [rsp + 0x30]
mov r8d, 0x104
mov rdx, rax
call fcn.140061f24
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140008454
lea rcx, [rsp + 0x30]
mov edx, edi
mov dword [rbx + 8], 2
call fcn.14004ec0c
lea edx, [rdi + 0x6e]
lea rcx, [0x14008ad40]
call fcn.140066f78
lea rcx, [rsp + 0x30]
mov r8d, 0x104
mov rdx, rax
call fcn.140061f24
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140008454
and word [rsp + 0x450], 0
mov edi, 0x20a
lea rcx, [rsp + 0x452]
mov r8, rdi
xor edx, edx
call sub.msvcrt.dll_memset
and word [rsp + 0x240], 0
lea rcx, [rsp + 0x242]
mov r8, rdi
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [0x14008ad40]
mov edx, 0x8c
call fcn.140066f78
lea rcx, [0x14008ad40]
mov edx, 0x8b
mov rdi, rax
call fcn.140066f78
lea r9, [rsp + 0x450]
mov r8, rdi
mov rcx, 0xffffffff80000001
mov rdx, rax
mov dword [rsp + 0x20], 0x104
call fcn.14004fbec
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x450]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x240]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x140008dc6
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x23e], 0x5c
jne 0x140008dc6
and word [rsp + rax*2 + 0x23e], 0
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140008dec
lea rdx, [rsp + 0x240]
mov rcx, rbx
call fcn.140008454
mov rbx, qword [rsp + 0x670]
add rsp, 0x660
pop rdi
ret
Function at 0x1400094b0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x80
mov rax, rdx
mov rsi, rcx
xor edi, edi
and dword [rsp + 0x48], edi
xor r12d, r12d
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x4c], 0x1388
mov qword [rsp + 0x40], r12
call fcn.140063024
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x1400096c7
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov ebx, eax
js 0x14000952e
lea ecx, [rax + 0x1388]
mov eax, 0xd1b71759
mul ecx
lea rcx, [rsp + 0x40]
shr edx, 0xc
imul edx, edx, 0x1388
call fcn.1400603d8
mov r12, qword [rsp + 0x40]
and dword [rsp + 0xb8], edi
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0xb8]
mov r8d, ebx
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov qword [rsp + 0x68], r12
lea edi, [rcx + 4]
mov dword [rsp + 0x60], ebx
cmp ebx, edi
cmovae ecx, edi
lea eax, [rcx + 0x10]
cmp eax, ebx
cmovbe ecx, eax
mov dword [rsp + 0x70], ecx
lea rcx, [rsp + 0x60]
call fcn.140061788
mov ecx, dword [rsp + 0x60]
mov r11d, dword [rsp + 0x70]
lea eax, [r11 + 8]
lea r8, [rsp + 0xb8]
mov edx, edi
cmp eax, ecx
cmovbe r11d, eax
lea eax, [r11 + 4]
cmp eax, ecx
cmovbe r11d, eax
lea eax, [r11 + 4]
cmp eax, ecx
cmovbe r11d, eax
lea eax, [r11 + 0x10]
cmp eax, ecx
cmovbe r11d, eax
lea eax, [r11 + 0x10]
cmp eax, ecx
lea rcx, [rsp + 0x60]
cmovbe r11d, eax
and dword [rsp + 0xb8], 0
mov dword [rsp + 0x70], r11d
call fcn.140060308
xor edi, edi
test eax, eax
je 0x1400096be
mov eax, dword [rsp + 0x70]
mov edx, dword [rsp + 0xb8]
mov rcx, rax
add eax, edx
add rcx, qword [rsp + 0x68]
cmp eax, dword [rsp + 0x60]
setbe dil
test edi, edi
je 0x1400096be
test edx, edx
je 0x1400096be
test rcx, rcx
je 0x1400096be
and dword [rsp + 0x50], 0
xor eax, eax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], edx
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xb8]
xor r9d, r9d
xor r8d, r8d
call fcn.1400578cc
test eax, eax
mov edi, eax
je 0x1400096d0
mov r12d, dword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rcx, rsi
mov r8d, r12d
mov rdx, rbp
call fcn.140008f50
test eax, eax
mov edi, eax
jne 0x1400096b3
lea rcx, [rsi + 0xf0]
mov edx, r12d
call fcn.140060478
mov rcx, qword [rsi + 0xf0]
mov r8, r12
mov rdx, rbp
call sub.msvcrt.dll_memcpy
mov dword [rsi + 0x58], 0xffffffeb
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400096d0
mov dword [rsi + 0x58], 0xffffffec
jmp 0x1400096d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x58], eax
lea rcx, [rsp + 0x40]
call fcn.140060398
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140009700
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1280
call fcn.1400751b0
sub rsp, rax
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
xor esi, esi
mov rbp, rdx
repne scasw ax, word [rdi]
not rcx
add rcx, 0xb
cmp rcx, 0x1ff
jae 0x140009757
lea r8, [rsp + 0x20]
lea rdx, str.Policy.vpol
mov rcx, rbp
call fcn.1400639e4
jmp 0x14000975c
and word [rsp + 0x20], ax
lea rdx, [rsp + 0x20]
mov r8d, 1
mov rcx, rbx
call fcn.1400094b0
test eax, eax
je 0x140009804
or qword [rsp + 0x420], 0xffffffffffffffff
and word [rsp + 0x428], si
and word [rsp + 0xe80], si
and word [rsp + 0xa80], si
lea rax, [rsp + 0x428]
lea rdx, str..vcrd
lea rcx, [rsp + 0x420]
mov r8, rbp
mov qword [rsp + 0x828], rax
call fcn.140061348
jmp 0x1400097e6
lea rdx, [rsp + 0xa80]
mov rcx, rbx
call fcn.140009020
test eax, eax
je 0x1400097e6
mov rax, qword [rbx]
lea rdx, [rbx + 0x60]
mov rcx, rbx
mov esi, 1
call qword [rax]
lea rcx, [rsp + 0x420]
call fcn.140061268
test eax, eax
jne 0x1400097c1
lea rcx, [rsp + 0x420]
call fcn.1400605d8
lea r11, [rsp + 0x1280]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000d728
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rsi, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov edi, eax
jne 0x14000d767
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000d767
mov dword [rbx + 0x1c], eax
mov eax, 0x70a
jmp 0x14000d777
mov ecx, dword [rsp + 0x30]
shl rcx, 0x20
add rcx, rdi
xor eax, eax
mov qword [rsi], rcx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14000dbe8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
test edx, edx
mov r10d, edx
jle 0x14000dc19
movzx r8d, byte [rcx]
lea rdx, [0x14007a0f0]
sub r10d, 1
movzx r9d, byte [r8 + rdx]
mov edx, eax
add rcx, 1
shl edx, 3
xor r9d, edx
xor eax, r9d
test r10d, r10d
jg 0x14000dbf1
ret
Function at 0x14000f6a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test rcx, rcx
mov rbx, rdx
mov rdi, rcx
je 0x14000f7ab
test rdx, rdx
je 0x14000f7ab
bt word [rcx + 2], 0xb
jb 0x14000f74c
movzx eax, word [rdx + 2]
bt ax, 0xb
jb 0x14000f74c
xor al, byte [rcx + 2]
test al, 0x10
jne 0x14000f74c
mov al, byte [rdx]
cmp byte [rcx], al
jne 0x14000f74c
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rcx + 0x10]
call fcn.14000f6a8
test eax, eax
jne 0x14000f74c
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.14000f6a8
test eax, eax
jne 0x14000f74c
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.14000b388
test eax, eax
jne 0x14000f74c
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x14000f74c
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x14000f74c
movzx r10d, word [rdi + 2]
bt r10w, 0xa
jae 0x14000f753
bt word [rbx + 2], 0xa
jae 0x14000f74c
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x14000f77b
mov eax, 2
jmp 0x14000f7b6
cmp byte [rdi], 0x98
je 0x14000f77b
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000f77b
bt word [rbx + 2], 0xa
jb 0x14000f74c
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x14000f74c
call fcn.14000e058
test eax, eax
jne 0x14000f74c
movzx eax, word [rbx + 2]
mov cx, 0x100
and ax, cx
and r10w, cx
cmp r10w, ax
je 0x14000f797
mov eax, 1
jmp 0x14000f7b6
test r10w, r10w
je 0x14000f7a7
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x14000f74c
xor eax, eax
jmp 0x14000f7b6
sub rbx, rcx
neg rbx
sbb eax, eax
and eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140011458
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rax, rdx
mov rdi, rcx
cmp dword [rcx + 0x38], ebx
je 0x140011481
movsxd r8, dword [rcx + 0x38]
lea rax, [r8 + rdx - 1]
cqo
idiv r8
imul rax, r8
mov rdx, rax
call fcn.14000d828
cmp eax, ebx
jne 0x1400114a4
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, ebx
jne 0x1400114a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x1c], eax
mov ebx, 0x60a
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140015328
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
sub rsp, 0x20
xor ebx, ebx
mov rcx, rdx
mov edi, ebx
mov esi, ebx
call fcn.140013c88
cmp rax, rbx
mov r13, rax
jne 0x14001535f
lea eax, [rbx + 7]
jmp 0x1400153fa
call fcn.14000db18
cmp eax, ebx
je 0x1400153a4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov r12d, eax
jne 0x14001538f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov esi, eax
jne 0x1400153e0
add edi, 1
cmp edi, 5
jge 0x1400153e0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140015368
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov r12d, eax
jne 0x1400153cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov esi, eax
jne 0x1400153e0
add edi, 1
cmp edi, 5
jge 0x1400153e0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400153a4
mov rcx, r13
call sub.msvcrt.dll_free
cmp r12d, 0xffffffff
jne 0x1400153f3
cmp esi, 2
je 0x1400153f8
mov ebx, 0xa0a
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
add rsp, 0x20
pop r13
ret
Function at 0x140025398
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x340
mov r9, qword [0x14008e998]
mov rbx, rdx
test r9, r9
je 0x1400253d4
lea r8, [0x14007d8d8]
lea rdx, [rsp + 0x20]
mov ecx, 0xe6
call fcn.1400208c8
jmp 0x14002545d
call fcn.14000db18
mov ecx, 0xe6
test eax, eax
je 0x14002541f
lea rdx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x130]
call fcn.14000d9e8
test rax, rax
mov rdi, rax
jne 0x14002543c
mov eax, 7
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rdx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rsp + 0x130]
call fcn.140011638
jmp 0x1400253fd
lea r8, [0x14007d8d8]
lea rdx, [rsp + 0x20]
mov r9, rax
mov ecx, 0xe6
call fcn.1400208c8
mov rcx, rdi
call sub.msvcrt.dll_free
mov r8b, byte [rsp + 0x20]
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0x20]
test r8b, r8b
je 0x14002547a
add rcx, 1
cmp byte [rcx], 0
jne 0x140025471
sub ecx, eax
lea rax, str.etilqs_
mov edi, 0x3fffffff
mov rdx, rax
and ecx, edi
add rdx, 1
cmp byte [rdx], 0
jne 0x14002548d
sub edx, eax
and edx, edi
lea ecx, [rdx + rcx + 0x11]
cmp ecx, 0x105
jl 0x1400254b0
mov eax, 1
jmp 0x14002540a
test r8b, r8b
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x20]
je 0x1400254c8
add rax, 1
cmp byte [rax], 0
jne 0x1400254bf
sub eax, ecx
and eax, edi
movsxd rcx, eax
je 0x1400254e3
lea rax, [rsp + 0x20]
cmp byte [rax + rcx - 1], 0x5c
jne 0x1400254e3
sub rcx, 1
jne 0x1400254d6
mov byte [rsp + rcx + 0x20], 0
lea r9, [rsp + 0x20]
lea r8, str._setilqs_
mov rdx, rbx
mov ecx, 0xf4
call fcn.1400208c8
test rbx, rbx
mov r11, rbx
je 0x14002551e
cmp byte [rbx], 0
je 0x140025518
add r11, 1
cmp byte [r11], 0
jne 0x14002550e
sub r11d, ebx
and r11d, edi
movsxd rdi, r11d
mov esi, InitCommonControls
lea rdx, [rdi + rbx]
mov ecx, esi
call fcn.140013df8
movzx ecx, byte [rdi + rbx]
movabs rax, 0x842108421084211
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
lea rax, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
mov al, byte [rcx + rax]
mov byte [rdi + rbx], al
add rdi, 1
sub rsi, 1
jne 0x140025531
mov byte [rdi + rbx], sil
xor eax, eax
jmp 0x14002540a