joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012958
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x298
mov esi, r9d
mov r14d, r8d
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r12d, r12d
cmp eax, 0xffffffff
je 0x140012be5
and eax, 0x10
je 0x140012be5
test esi, esi
jne 0x1400129d8
cmp dword [rsp + 0x300], 0
je 0x1400129d8
lea rcx, [0x140141c70]
lea r8, [0x14011b950]
xor edx, edx
mov r9, rdi
call fcn.140016430
test rbx, rbx
je 0x1400129cc
lea rcx, [0x140141c94]
mov rdx, rbx
call fcn.140016430
lea rcx, [0x140141ca0]
call fcn.140016430
mov edx, 0x208
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
xor r12d, r12d
test rax, rax
je 0x140012bdc
mov edx, 0x104
mov rcx, rbp
mov r8, rdi
call fcn.14010705c
test eax, eax
jne 0x140012bdc
lea r8, [0x140141ca4]
mov edx, 0x104
mov rcx, rbp
call fcn.140106fe4
test eax, eax
jne 0x140012bdc
test rbx, rbx
lea r8, [0x140141ca8]
cmovne r8, rbx
mov edx, 0x104
mov rcx, rbp
call fcn.140106fe4
test eax, eax
jne 0x140012bdc
lea rdx, [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140012bdc
mov r15, rax
lea r13, [rsp + 0x74]
lea eax, [rsi + rsi]
mov dword [rsp + 0x44], eax
lea eax, [rsi + 1]
mov dword [rsp + 0x40], eax
mov rcx, r13
lea rdx, str.hFFF
call fcn.140103e94
test eax, eax
je 0x140012bba
mov rcx, r13
lea rdx, [0x140141cb0]
call fcn.140103e94
test eax, eax
je 0x140012bba
mov edx, 0x104
mov rcx, rbp
mov r8, rdi
call fcn.14010705c
test eax, eax
jne 0x140012bba
mov edx, 0x104
mov rcx, rbp
lea r8, [0x140141ca4]
call fcn.140106fe4
test eax, eax
jne 0x140012bba
mov rcx, rbp
call fcn.1401070c4
mov r12, rax
mov edx, 0x104
mov rcx, rbp
mov r8, r13
call fcn.140106fe4
test eax, eax
jne 0x140012bba
cmp dword [rsp + 0x300], 0
je 0x140012b3d
xor eax, eax
test byte [rsp + 0x48], 0x10
sete al
add eax, eax
add eax, 0x44
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], eax
lea rcx, [0x140141cc0]
mov edx, dword [rsp + 0x44]
lea r8, [0x14011b950]
mov r9d, esi
call fcn.140016430
test byte [rsp + 0x48], 0x10
jne 0x140012b73
cmp qword [rsp + 0x308], 0
je 0x140012bba
mov eax, r12d
lea r8, [rax*2]
add r8, rbp
mov ecx, esi
mov rdx, rbp
mov r9, qword [rsp + 0x310]
call qword [rsp + 0x308]
jmp 0x140012bb3
test r14d, r14d
je 0x140012bba
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x300]
mov dword [rsp + 0x20], eax
mov rcx, rbp
mov rdx, rbx
mov r8d, 1
mov r9d, dword [rsp + 0x40]
call fcn.140012958
mov r12d, eax
test eax, eax
jne 0x140012bd3
mov rcx, r15
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140012a7c
xor r12d, r12d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, r12d
add rsp, 0x298
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140015610
Capabilities:
Get domain controller name

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, r8
mov rax, rcx
lea rcx, [rsp + 0x30]
mov qword [rcx], 0
or edx, 0x40020000
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edx
xor edi, edi
xor ecx, ecx
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
je 0x14001565e
lea rcx, [0x140142ad0]
mov edx, eax
call fcn.140016430
jmp 0x1400156b5
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
add rcx, 4
call fcn.1401070c4
lea edi, [rax + rax]
add edi, 2
mov ecx, 0x40
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x1400156a9
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
add rdx, 4
mov rcx, rax
mov r8, rdi
call fcn.1400eeb30
mov edi, 1
jmp 0x1400156ab
xor edi, edi
mov rcx, qword [rsp + 0x30]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1400156be
Capabilities:
Get hostname

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rdx
xor eax, eax
test ecx, ecx
setne al
lea ebx, [rax + rax*2]
add ebx, 4
lea r8, [rsp + 0x2c]
mov dword [r8], 0
xor edi, edi
mov ecx, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14001574d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14001574d
mov edx, dword [rsp + 0x2c]
add rdx, rdx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x140015763
lea r8, [rsp + 0x2c]
mov ecx, ebx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov edi, eax
test eax, eax
jne 0x140015763
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140142b10]
mov edx, eax
call fcn.140016430
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140015761
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140142b70]
mov edx, eax
call fcn.140016430
xor edi, edi
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140016021
Capabilities:
Compress data via winapi

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r9
mov r15, r8
mov edi, edx
mov r14, rcx
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x44]
mov cx, 0x102
call qword [sym.imp.ntdll.dll_RtlGetCompressionWorkSpaceSize]
xor ebp, ebp
test eax, eax
js 0x1400160c6
mov edx, dword [rsp + 0x40]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x1400160c6
mov rbx, rax
mov edx, edi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r15], rax
xor ebp, ebp
test rax, rax
je 0x1400160bd
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], 0x1000
mov cx, 0x102
mov rdx, r14
mov r8d, edi
mov r9, rax
call qword [sym.imp.ntdll.dll_RtlCompressBuffer]
mov ebp, 1
test eax, eax
jns 0x1400160bd
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400160d8
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov edx, 0x10
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x140016184
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, qword [rsi]
mov qword [rcx], rax
mov rcx, qword [rsi]
mov rax, qword [rcx]
test rax, rax
je 0x14001617f
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, qword [rsi]
mov qword [rcx + 8], rax
mov rcx, qword [rsi]
test rax, rax
je 0x14001617f
mov rax, qword [rcx + 8]
cmp dword [rax], 0x504d444d
jne 0x14001617f
movzx edx, word [rax + 4]
mov eax, 1
cmp edx, 0xa793
je 0x140016186
call fcn.14001618d
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140017fd4
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, rdx
mov esi, ecx
mov rdx, qword [rdx]
test rdx, rdx
je 0x14001800e
lea r9, [rsp + 0x2c]
mov ecx, esi
call sub.ntdll.dll_NtQuerySystemInformation
mov ebp, eax
mov eax, ebp
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ebx, 0x1000
mov r15, qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, ebx
mov ecx, 0x40
call r15
mov qword [rdi], rax
test rax, rax
je 0x140018060
mov ecx, esi
mov rdx, rax
mov r8d, ebx
mov r9, r14
call sub.ntdll.dll_NtQuerySystemInformation
mov ebp, eax
test eax, eax
jns 0x140017ffd
mov rcx, qword [rdi]
call r12
add ebx, ebx
cmp ebp, 0xc0000004
je 0x140018026
jmp 0x140017ffd
mov ebp, 0xc0000004
jmp 0x140017ffd
Function at 0x140018d7f
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rbp, r9
mov ebx, r8d
mov rdi, rdx
mov esi, ecx
mov r15, qword [rsp + 0x140]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0xc0], 0
mov dword [rsp + 0x60], 0x68
mov r14, r15
test r15, r15
jne 0x140018e02
mov edx, Ordinal_26
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x140018e66
mov rcx, rdi
call fcn.140103e10
test rax, rax
je 0x140018e66
mov rdi, rax
or ebx, 0x10
cmp esi, 2
je 0x140018e6d
cmp esi, 1
je 0x140018ebe
xor ebp, ebp
test esi, esi
jne 0x140018f28
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x140018efb
xor ebp, ebp
jmp 0x140018f3e
mov r8, qword [rsp + 0x138]
mov rdx, qword [rsp + reloc.WLDAP32.dll_Ordinal_304]
mov rcx, qword [rsp + 0x128]
mov r9d, dword [rsp + 0x120]
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_CreateProcessWithLogonW]
jmp 0x140018efb
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rbp
xor edx, edx
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CreateProcessAsUserW]
mov ebp, eax
test r15, r15
setne al
cmp dword [rsp + 0x148], 0
sete cl
test al, cl
jne 0x140018f28
test ebp, ebp
je 0x140018f28
mov rcx, qword [r14 + 8]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [r14]
call rsi
test r15, r15
jne 0x140018f36
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call fcn.1401062bc
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001b453
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov r12, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov eax, dword [rcx]
xor edi, edi
cmp eax, 1
je 0x14001b4b3
test eax, eax
jne 0x14001b529
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
mov rcx, rdx
mov rdx, r8
mov r8, r9
mov r9, rbx
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x14001b507
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14001b529
mov rsi, rcx
call fcn.14001b332
test rax, rax
je 0x14001b529
mov r15d, dword [rax + 8]
test rbx, rbx
je 0x14001b4ce
mov ecx, dword [rax + 0x10]
mov dword [rbx], ecx
test r12, r12
je 0x14001b507
and r15d, 0x7fffffff
mov edi, 1
test r14, r14
je 0x14001b525
xor edi, edi
cmp dword [r12], r15d
jb 0x14001b525
cmp dword [rax + 8], 0
js 0x14001b50e
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + 0x10]
movsxd rax, dword [rax + 0xc]
add rax, rcx
add rax, 4
jmp 0x14001b512
mov edi, 1
jmp 0x14001b529
add rax, 0xc
mov rcx, r14
mov rdx, rax
mov r8, r15
call fcn.1400eeb30
mov edi, 1
mov dword [r12], r15d
mov eax, edi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14001b539
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov ebp, dword [rsp + 0x90]
mov r14, qword [rsp + 0x88]
mov ebx, dword [rsp + 0x80]
mov eax, dword [rcx]
xor esi, esi
cmp eax, 1
je 0x14001b58d
test eax, eax
jne 0x14001b5f2
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r14
mov rcx, rdx
mov rdx, r8
mov r8d, r9d
mov r9d, ebx
call qword [sym.imp.advapi32.dll_RegSetValueExW]
test eax, eax
je 0x14001b5ed
mov ecx, eax
jmp 0x14001b5b1
mov rdi, rcx
call fcn.14001b332
test rax, rax
je 0x14001b5f2
mov ecx, dword [rax + 8]
mov r8d, ecx
and r8d, 0x7fffffff
cmp r8d, ebp
jae 0x14001b5b9
mov ecx, Ordinal_54
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14001b5f2
and ecx, 0x80000000
mov dword [rax + 0x10], ebx
or ecx, ebp
mov dword [rax + 8], ecx
js 0x14001b5de
mov rcx, qword [rdi + 8]
mov rcx, qword [rcx + 0x10]
movsxd rax, dword [rax + 0xc]
add rax, rcx
add rax, 4
jmp 0x14001b5e2
add rax, 0xc
mov rcx, rax
mov rdx, r14
call fcn.1400eeb30
mov esi, 1
mov eax, esi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14001b5ff
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r9
mov rdi, rcx
mov rax, qword [rsp + 0xd0]
mov r13, qword [rsp + 0xc8]
mov r14, qword [rsp + 0xc0]
mov r15, qword [rsp + 0xb0]
mov ecx, dword [rcx]
xor ebx, ebx
cmp ecx, 1
je 0x14001b689
test ecx, ecx
jne 0x14001b734
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov edx, r8d
mov r8, rsi
mov r9, r15
call qword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
je 0x14001b72f
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14001b734
cmp dword [rdx + 0x18], r8d
jbe 0x14001b734
movsxd rcx, dword [rdx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x14001b734
mov rbp, qword [rdi + 8]
mov r12, qword [rbp + 0x10]
movzx ebp, word [r12 + rcx + 4]
cmp ebp, 0x686c
je 0x14001b6c2
movzx ebp, bp
cmp ebp, 0x666c
jne 0x14001b734
add rcx, r12
movzx ebp, word [rcx + 6]
test ebp, ebp
je 0x14001b734
cmp ebp, r8d
jbe 0x14001b734
test r15, r15
je 0x14001b734
test rsi, rsi
je 0x14001b734
mov ebp, r8d
movsxd rcx, dword [rcx + rbp*8 + 8]
movzx ebp, word [r12 + rcx + 4]
cmp ebp, 0x6b6e
jne 0x14001b734
add r12, rcx
test rax, rax
je 0x14001b701
mov rcx, qword [rdx + 8]
mov qword [rax], rcx
test byte [r12 + 6], 0x20
movzx ebp, word [r12 + 0x4c]
jne 0x14001b747
shr ebp, 1
xor ebx, ebx
cmp dword [r15], ebp
jbe 0x14001b78c
lea rax, [r12 + 0x50]
movzx r8d, word [rdx + 0x4c]
mov rcx, rsi
mov rdx, rax
call fcn.1400eeb30
jmp 0x14001b77f
mov ebx, 1
mov eax, ebx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebx, ebx
cmp dword [r15], ebp
jbe 0x14001b78c
mov ebx, ebp
lea rcx, [r12 + 0x50]
mov rdx, rbx
call fcn.140023c50
test rax, rax
je 0x14001b77f
add rbx, rbx
mov rcx, rsi
mov rdx, rax
mov r8, rbx
mov rbx, rax
call fcn.1400eeb30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebp
mov word [rsi + rax*2], 0
mov ebx, 1
mov dword [r15], ebp
test r13, r13
je 0x14001b734
movzx r8d, word [r12 + 0x4e]
mov rsi, r8
shr rsi, 1
test r14, r14
je 0x14001b7d6
xor ebx, ebx
cmp dword [r13], esi
jbe 0x14001b7d6
mov rax, qword [rdi + 8]
mov rax, qword [rax + 0x10]
movsxd rcx, dword [r12 + 0x34]
lea rdx, [rax + rcx]
add rdx, 4
mov rcx, r14
call fcn.1400eeb30
mov word [r14 + rsi*2], 0
mov ebx, 1
mov dword [r13], esi
jmp 0x14001b734
Function at 0x14001b7df
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r9
mov rbp, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xd8]
mov r13, qword [rsp + 0xd0]
mov r15, qword [rsp + 0xc0]
mov eax, dword [rcx]
xor esi, esi
cmp eax, 1
je 0x14001b866
test eax, eax
jne 0x14001b9d1
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov rcx, rdx
mov edx, r8d
mov r8, rdi
mov r9, r15
call qword [sym.imp.advapi32.dll_RegEnumValueW]
test eax, eax
je 0x14001b9cc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14001b9d1
mov rbx, rcx
test rdx, rdx
jne 0x14001b876
mov rax, qword [rbx + 8]
mov rdx, qword [rax + 0x18]
movzx eax, word [rdx + 4]
cmp eax, 0x6b6e
jne 0x14001b9d1
cmp dword [rdx + 0x28], r8d
jbe 0x14001b9d1
movsxd rax, dword [rdx + 0x2c]
cmp rax, 0xffffffffffffffff
je 0x14001b9d1
test r15, r15
je 0x14001b9d1
test rdi, rdi
je 0x14001b9d1
mov rcx, qword [rbx + 8]
mov r12, qword [rcx + 0x10]
add rax, r12
mov ecx, r8d
movsxd rax, dword [rax + rcx*4 + 4]
movzx ecx, word [r12 + rax + 4]
cmp ecx, 0x6b76
jne 0x14001b9d1
add r12, rax
movzx eax, word [r12 + 6]
test eax, eax
je 0x14001b92a
test byte [r12 + 0x14], 1
mov qword [rsp + 0x48], rax
jne 0x14001b936
lea rdx, [rax + 2]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x14001b9d1
shr qword [rsp + 0x48], 1
lea rdx, [r12 + 0x18]
movzx r8d, word [r12 + 6]
mov rcx, rax
mov qword [rsp + 0x50], rax
call fcn.1400eeb30
mov rdx, qword [rsp + 0x50]
jmp 0x14001b945
mov dword [r15], 0
jmp 0x14001b9d1
mov edx, eax
lea rcx, [r12 + 0x18]
call fcn.140023c50
mov rdx, rax
test rdx, rdx
je 0x14001b9d1
mov rax, qword [rsp + 0x48]
cmp dword [r15], eax
jbe 0x14001b9e4
mov rsi, rax
inc eax
mov r8d, eax
add r8, r8
mov rcx, rdi
mov rdi, rdx
call fcn.1400eeb30
mov dword [r15], esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [r12 + 8]
test r13, r13
je 0x14001b991
mov eax, dword [r12 + 0x10]
mov dword [r13], eax
test rbp, rbp
je 0x14001b9cc
and edi, 0x7fffffff
mov esi, 1
test r14, r14
je 0x14001ba06
xor esi, esi
cmp dword [rbp], edi
jb 0x14001ba06
cmp dword [r12 + 8], 0
js 0x14001b9ef
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x10]
movsxd rcx, dword [r12 + 0xc]
lea r12, [rax + rcx]
add r12, 4
jmp 0x14001b9f3
mov esi, 1
mov eax, esi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14001b9d1
add r12, 0xc
mov rcx, r14
mov rdx, r12
mov r8, rdi
call fcn.1400eeb30
mov esi, 1
mov dword [rbp], edi
jmp 0x14001b9d1
Function at 0x14001c9ec
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov rbp, r8
mov r15d, edx
mov r12, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov word [rsp + 0x30], 0x103
movzx ebx, r9b
lea rsi, [rbx + 5]
mov byte [rsp + 0x32], sil
xor edi, edi
lea rcx, [rsp + 0x50]
mov r8d, 0x100
xor edx, edx
call fcn.1400ef1e0
cmp bl, 0x11
ja 0x14001cc1a
mov r13, qword [rsp + 0x1c8]
mov r14, qword [rsp + 0x1c0]
lea rcx, [rsp + 0x34]
mov byte [rcx - 1], r15b
mov rdx, rbp
mov r8, rbx
call fcn.1400eeb30
lea eax, [rbx + 3]
xor ebp, ebp
mov cl, 1
lea rdi, [rsp + 0x30]
xor edx, edx
mov ebp, ebp
xor dl, byte [rbp + rdi + 1]
movzx ebp, cl
inc cl
cmp eax, ebp
ja 0x14001ca7c
mov byte [rbx + rdi + 4], dl
mov byte [rsp + rsi + 0x30], 4
mov rcx, r12
mov edx, reloc.WLDAP32.dll_Ordinal_12
call qword [sym.imp.KERNEL32.dll_PurgeComm]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rcx, r12
mov rdx, rdi
mov r8d, Ordinal_26
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001cbe5
cmp dword [rsp + 0x2c], 0x18
jne 0x14001cbe5
mov rsi, r14
xor edi, edi
mov rcx, r12
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
lea r14, [rsp + 0x50]
lea r9, [rsp + 0x2c]
mov rcx, r12
mov rdx, r14
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001cbf6
mov edx, dword [rsp + 0x2c]
cmp edx, 6
jb 0x14001cc0c
cmp byte [rsp + 0x50], 5
jne 0x14001cc30
cmp byte [rsp + 0x51], 1
jne 0x14001cc30
mov al, byte [rsp + 0x52]
cmp al, 5
jb 0x14001cc39
or r15b, 0x80
cmp byte [rsp + 0x53], r15b
jne 0x14001cc39
add al, 0xfb
movzx r15d, al
lea ecx, [r15 + 3]
xor ebp, ebp
mov bl, 1
xor edx, edx
mov ebp, ebp
movzx ebp, byte [rbp + r14 + 1]
xor edx, ebp
movzx ebp, bl
inc bl
cmp ecx, ebp
ja 0x14001cb79
movzx ecx, byte [r15 + r14 + 4]
cmp edx, ecx
jne 0x14001cc47
cmp byte [r15 + r14 + 5], 4
jne 0x14001cc47
mov edi, 1
test r13, r13
je 0x14001cc1a
test rsi, rsi
je 0x14001cc1a
test al, al
je 0x14001cc1a
mov byte [r13], al
mov ecx, 0x40
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x14001cc18
lea rdx, [rsp + 0x54]
mov rcx, rax
mov r8, r15
call fcn.1400eeb30
jmp 0x14001cc1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140144930]
mov edx, eax
jmp 0x14001cc13
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1401448f0]
mov edx, eax
call fcn.140016430
jmp 0x14001cc1a
lea rcx, str.xxx7xxXxXxCxXxx
call fcn.140016430
xor edi, edi
mov eax, edi
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.___4_____9
jmp 0x14001cc40
lea rcx, [0x140144830]
call fcn.140016430
jmp 0x14001cc18
lea rcx, [0x140144800]
jmp 0x14001cc40
Function at 0x140020148
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
test rdx, rdx
lea rbx, [0x140177ab8]
cmovne rbx, rdx
mov rdi, qword [rcx + 8]
movabs rax, 0x1000000010
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
cmp qword [rbx + 8], 0
je 0x140020274
cmp dword [rbx], 0
je 0x140020274
mov rsi, rcx
cmp dword [rcx], 0x14
jb 0x14002027d
test rdi, rdi
je 0x14002027d
lea r14, [rsp + 0x58]
mov rcx, r14
call sub.cryptdll.dll_MD5Init
mov r8d, dword [rbx]
mov rdx, qword [rbx + 8]
mov rcx, r14
call sub.cryptdll.dll_MD5Update
mov rcx, r14
mov rdx, rdi
mov r8d, 0x10
call sub.cryptdll.dll_MD5Update
mov rcx, r14
call sub.cryptdll.dll_MD5Final
mov eax, dword [rsi]
add eax, 0xfffffff0
lea rcx, [rsp + 0x48]
mov dword [rcx + 4], eax
mov dword [rcx], eax
lea r14, [rdi + 0x10]
mov qword [rcx + 8], r14
lea rdx, [rsp + 0x38]
call sub.advapi32.dll_SystemFunction032
test eax, eax
js 0x140020286
mov ebx, dword [rsi]
add ebx, 0xffffffec
add rdi, 0x14
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov ecx, 0x8000
mov rdx, rdi
mov r8d, ebx
call fcn.140006b54
test eax, eax
je 0x14002028f
mov edx, dword [rsp + 0x34]
mov r8d, dword [r14]
cmp edx, r8d
jne 0x1400202ac
mov r14, qword [rsi + 8]
mov r15d, ebx
mov rcx, r15
call fcn.14001dfda
mov qword [rsi + 8], rax
test rax, rax
je 0x14002029b
mov rcx, rax
mov rdx, rdi
mov r8, r15
call fcn.1400eeb30
mov dword [rsi], ebx
mov rcx, r14
call fcn.14001dfe9
mov eax, 1
jmp 0x14002029d
lea rcx, [0x140145df0]
jmp 0x140020296
lea rcx, [0x140145dc0]
jmp 0x140020296
lea rcx, [0x140145d80]
jmp 0x140020296
lea rcx, [0x140145d30]
call fcn.140016430
xor eax, eax
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x140145cc0]
call fcn.140016430
jmp 0x14002029b